Scaling up the randomized gradient-free adversarial attack reveals overestimation of robustness using established attacks