Can we have it all? On the Trade-off between Spatial and Adversarial Robustness of Neural Networks