Security boundaries of an optical-power limiter for protecting quantum-key-distribution systems