Navigating security trade-offs when implementing account abstraction in smart contracts