Face Reconstruction Transfer Attack as Out-of-Distribution Generalization