Most ReLU Networks Suffer from $\ell^2$ Adversarial Perturbations