On the Vulnerability of Concept Erasure in Diffusion Models