Is cross-chain really just as simple as clicking a button?

I’m increasingly treating "cross-chain" as a trust checklist: who sent the message, who confirms on the other side, how is proof generated, who verifies on-chain, what if someone acts maliciously—how to rollback/how to compensate... I really like the idea behind IBC; at least it separates verification and message passing more clearly. But honestly, you still have to trust that the light client implementation is bug-free, that consensus doesn’t break, that the relayer doesn’t slack off, and that your frontend doesn’t give you a "different token with the same name" channel.
Lately, with all the NFT royalty disputes, it feels similar: everyone wants smoother secondary liquidity, but creators don’t want to be bypassed. In the end, it all comes down to "who do you trust to enforce the rules?"
Anyway, I only use the cross-chain method I can clearly explain myself. If I can’t explain it clearly, I avoid messing with it.