How much do you actually need to trust in a cross-chain operation?

After thinking about it, it's really not about treating the "bridge" as a rope; frankly, it's a series of components: your chain's contract/module, how the sender proves they actually sent the message, who on the other chain verifies it, how to execute after verification, and whether the middle relay/observer has room to mess around.
IBC's approach at least involves embedding verification into the chain, which feels more reassuring than multi-signature bridges that rely on trusting a few guys, but it's not immune.
If any of the steps—light clients, consensus security, timeout rollbacks—are weak, issues can still arise.
By the way, I want to criticize the labels on many on-chain data tools now; once you get into cross-chain assets, they quickly fall behind, lagging and easily misleading…
Anyway, when I look at liquidity and onboarding, I first ask how this asset was transferred and who is endorsing it, otherwise, a seemingly stable floor price could just be hollow.