I'm not very good at explaining big principles, but granting unlimited authorization in a contract is really like locking the door before bed—if you don't do it, you'll feel uneasy.

Many people think "I haven't confirmed any transactions, so it's fine," but actually, once you've clicked approve once, the permission is hanging there.
Later, if the project team/frontend gets malware or you accidentally click a phishing link, it could drain all similar tokens in your wallet, regardless of whether you've taken any action at that moment.

Recently, hardware wallets are out of stock, and there are still a bunch of phishing links in the group.
The more these situations happen, the less you should slack off: after using DEX or lending platforms, revoke the authorization promptly, at least change unlimited to a specific amount.
Anyway, now that I’m running across L2s, after bridging and swapping tokens, the first thing I do is check the authorization list, or I really can't sleep peacefully at night.