Lately I've been looking into IBC and various message passing protocols, and the more I look, the more I feel that cross-chain is just like "APR is attractive" — behind the numbers, it's all about trust chains...

What exactly do you trust in a cross-chain?
Honestly, first you trust the consensus/finality of the two chains themselves, then trust that the light client/verification logic isn't messed up, next is the relayer — although theoretically it shouldn't be trusted, if it gets compromised, you're screwed, and finally there are various small components like front-end, routing, and quota configurations of "bridge shells" that people tend to overlook.

Modularization/DA development has definitely excited developers, and it's normal for users to be confused: who is ensuring data availability, who is ensuring messages aren't tampered with, in the end it all boils down to "who do I trust."
I now have too much information and feel a bit anxious; my filtering method is simple: I don't look at promotional TPS/APR/vision figures, I directly draw trust boundaries — funds need to pass through multiple signatures/verification steps, and if there's a single point of malicious activity, who can exploit it?
If I can't draw it out, I won't touch it. Forget it.