You are correct, if 12 witnesses so decide, they can block all attempts to replace them. But this is exactly what they were expected not to do when they were added themselves.  If a minority of witnesses appears untrustworthy, they can be promptly replaced before they reach majority.

I discuss in the whitepaper a mechanism which helps make the behavior of witnesses more predictable and earlier detect any breaches of trust:  a would-be witness pledges to follow the witness lists of a few (possibly larger than 12) prominent industry leaders.  The pledge is not enforceable in the protocol but publicly auditable, any breach of the pledge would immediately make the witness a candidate for removal.