You Can't Scale Web3 w/o Better On-chain Security