Marketplaces bear primary responsibility for the security risks of legacy smart contract approvals