The accounts balances RPC returns possibly unconfined data.
It should be changed to return only confirmed data by default, by use of include_only_confirmed option.
Like the RPC account_balance does.