 transfers via `transferfrom` can be invoked usually by anyone. that's not an on-chain risk but can be used off-chain for e.g. phishing. question: should zero `transferfrom` calls be reverted? this will potentially break some stuff tho!