MCP is hitting a security and overhead reckoning in 2026: is the protocol itself flawed, or are teams just using it wrong?