The NES can be damaged by software, so removing the cartridge at just the wrong timing could theoretically damage the console.

The 2CO2 PPU in the NES normally reads the background color from palette index 0, but this isn't hard-wired into the chip -- it actually reads the palette index of the background from four EXT pins. These pins are grounded on the NES, forcing the palette index to 0, but an arcade board using the 2CO2 or a similar chip could connect these pins to another PPU.

Bit 6 of PPUCTRL selects whether the PPU should run in master or slave mode. If the PPU is in master mode, it reads the palette index from the EXT pins as explained above, but in slave mode, it outputs the palette indices it is currently drawing to the EXT pins.

This way, the images from two PPUs can be layered. The slave PPU draws one image, and the master draws another image on top of that and outputs the combined images.*

The NES didn't use that feature, but the hardware still exists in the PPU. If the PPU is set to slave mode, it will attempt to output the background palette index to the EXT pins. If it outputs a 1 to any of these pins, it will cause a short from Vcc, through the PPU, and to ground (because the EXT pins are grounded).

Suppose the game is writing to its memory, for example address $200 :

sta $0200

If the cartridge is removed at just the wrong time and D7 floats high, that instruction could become sta $2220 , which is mirrored to $2000 . If bit 6 of A is set, the PPU will be set into slave mode and potentially damaged. It's unlikely that just the right bit will be flipped at just the right time, but it's possible.

*: The image generated by the slave PPU can only use colors from the background palette of the main PPU because there are only 4 EXT pins, not 5.