Lately I've been looking into IBC and various message passing/bridge implementations, and the more I look, the more I feel that a cross-chain transfer is essentially just counting "who do I trust more."

In an ideal IBC scenario, both sides have light clients verifying each other's state, which is relatively clean; but many bridges quickly turn into: a group of relayers transporting data + multi-signature/validator set endorsements + upgrade permissions in whose hands.
I'm most sensitive about permissions—whether the contract can change logic at any time, whether the admin is a master key—these determine whether I dare to sleep peacefully.

Recently, the staking and shared security setups have also been hotly debated; the compounded yields look attractive, but adding an "outsourced security" layer in cross-chain feels like extending the trust chain...
Thinking about it later, it's quite funny. I write scripts to run strategies quite rigorously, but once cross-chain, I hand myself over to a bunch of invisible components.
Anyway, my current approach is very simple: if native IBC is available, I won't bother with fancy bridges; if I must use one, I first review permissions and upgrade paths, even if it slows things down.