I've been researching this some (because I'm a nerd). What they are saying is theoretically true.
GM uses a hashing algorithm to compute a checksum of the tune. The hashing function they use is most likely a 32 bit key space which is over 4 billion values, but with a big enough input size, eventually all hashing algorithms will have duplicate keys. What that means is that it's possible to have 2 different tune files hash to the same key, and thus not be detectable by the version checker.
However, it's not a simple thing to construct 2 inputs that hash to the same key, and it still has to be a valid tune file that does what you want. I'm not sure how big the image actually is, but I'm pretty sure it's less than 4GB, which makes it a lot less likely.
So, long story short, I'm skeptical that it can be done.
Here is a link to the patent if anyone wants get nerdy. http://www.google.com/patents/US20120245788