A cartel / collusion, I think is if some of the 12 witnesses would cooperate behind the scenes. That is ground for schism. Because then it would take too long time to change them. If 6 witnesses are in collusion and are actually acting as 1.
All 12 can be replaced, it just takes longer time, exactly to prevent changing all 12 at once to "Great Enterprise Censored Network". This is the point schisms addresses in the whitepaper.
Just a moment Ill find whitepaper reference to how more than 1 witness can be changed - there is a rule, when 1 witness changed becomes stable enough for the others to be allowed to change.
This is indeed an interesting aspect of the system. How a new witness can be introduced - does the whole network (all full nodes) need to accept it (include in its witness list) or 51% (?) and whether remaining 11 witnesses have the veto power to prevent it from happening? This is not clearly explained in the whitepaper. I think tonych would be helpful in clarifying this issue as it is of paramount importance to the security of the system.
Let's imagine that 12 witnesses formed a cartel. They will not change their own witness list. The rest of the network decided to change 1 witness (they are only allowed to change just 1). Now how there can be a second witness changed? If any user tries to change the second witness in its list it will cause its list to differ by 2 with regard to the remaining 11 witness own witness list. Remember that there's a cartel - remaining 11 witnesses won't allow the second witness to be changed (they will not allow their own witness list to be changed). I think this prevents the second witness from being introduced.
You are correct, if 12 witnesses so decide, they can block all attempts to replace them. But this is exactly what they were expected not to do when they were added themselves. If a minority of witnesses appears untrustworthy, they can be promptly replaced before they reach majority.
I discuss in the whitepaper a mechanism which helps make the behavior of witnesses more predictable and earlier detect any breaches of trust: a would-be witness pledges to follow the witness lists of a few (possibly larger than 12) prominent industry leaders. The pledge is not enforceable in the protocol but publicly auditable, any breach of the pledge would immediately make the witness a candidate for removal.