Claude Code Security and Magecart: Getting the Threat Model Right