Running L2 too much, I realize the most expensive thing isn't gas, but a misclick.

Treat mnemonic phrases like cash, don't screenshot or store them in the cloud, keep them offline if possible;
Some "wallet customer service / airdrop registration" ask you to fill in words, just block them directly.
Don't find signing authorization a hassle either, if a popup asks for "unlimited authorization," stop first, revoke authorization once you're done, it's really not worth saving a few seconds.
Phishing sites are even more outrageous, with domain names that look similar, pages that mimic real ones, basically just waiting for you to slip up.

Seeing the criticism that the staking/sharing safety features are just "nested tricks," I can understand.
The more flashy the yield stacking, the more entry points there are, and the more phishing sites love to lurk around these entry points.
Anyway, I now prefer to earn less rather than use my main wallet to try new links, for now that's how it is.