On the Robustness of Removal-Based Feature Attributions