How much can a plane deviate from its route to Paris (CDG and ORY) before an alert is raised?
I think "it seems like (quite understandably) that planes avoid Paris intra muros" is jumping a bit to conclusions. I went to Flightradar24 and found this, without even waiting for anything interesting to happen:



It didn't go exactly over the Notre-Dame, but even on this scale you should be able to see that it did cross inside Boulevard Périphérique.

On the other side of the Channel, such overflights are extremely routine when Heathrow operates east-to-west (as it usually does). Here's one (again found live, without waiting for it) that could have dropped bombs on the Crown Jewels if it had any to drop:



Perhaps more relevant than the Crown Jewels, this flight path is just a few hundred meters from the City of London skyscrapers. If the pilots had wanted to reenact 9/11, they could have crashed into something tall and famous about 10 to 20 seconds after deviating from their expected horizontal flight path. (But they'd need a bit more time than that to descend -- call it a minute or so from the first non-routine control input).