[Bug]: Token autodetection surfaces fake/non-transfer BEP-20 balances from arbitrary balanceOf() responses

### Describe the bug

A newly generated MetaMask account with no on-chain activity and no BEP-20 transfer history is shown as holding autodetected tokens. The tokens do not appear in explorer transfer history, but the token contract's Read Contract -> balanceOf(address) returns a nonzero value for the fresh address.

This appears to allow scam/nonstandard token contracts to make MetaMask display arbitrary balances for accounts that never received the token.

### Expected behavior

Expected behavior:
MetaMask should not prominently display autodetected tokens as normal wallet assets when:
- the account has no transfer/mint event history for that token, and
- the token appears only because balanceOf(address) returns a nonzero value.

At minimum, MetaMask should classify these as suspicious/unverified autodetected assets, hide them by default, deprioritize them, or warn that no transfer event exists.

### Screenshots/Recordings

_No response_

### Steps to reproduce

- Create a fresh MetaMask account / wallet.
- MetaMask displays Position and/or TangYuan token balances.
- BscScan shows no token transfer events to the address.
- Calling balanceOf(address) on the token contract returns:
100000000000000
- MetaMask treats this as an asset balance and surfaces it prominently.

### Error messages or log output

```shell

```

### Where was this bug found?

Live version (from official store)

### Version

13.28.0

### Build type

None

### Browser

Firefox

### Operating system

Linux

### Hardware wallet

_No response_

### Additional context

Position Token example: Will return a balanceOf for any validate address.

https://bsctrace.com/address/0x5ca42204cdaa70d5c773946e69de942b85ca6706?tab=Contract&p=1&view=contract_read

account (address)
uint256
100000000000000

### Severity

While this feature of auto discovery can be turned off, it seems like it's quite flawed in this implementation and needs to further check if an actual transfer exists.

No files or tests are named. Reproduce with a fresh MetaMask account using the Position or TangYuan example, compare the contract's balanceOf(address) result with BscScan transfer history, and trace the autodetection entry point. Done means an asset with no transfer or mint history is no longer prominently shown as a normal wallet balance, or is clearly marked and deprioritized.

Written by the indexing model from the issue text.