Box-Free Model Watermarks Are Prone to Black-Box Removal Attacks