The real question isn't "Is this protocol secure?" It's "Does it still work when incentives disappear?"

If the answer is no, risk already exists