The AI security question leaders should be asking instead