isn't the threat very minimal with hashed addresses where the address is only revealed to spend?