To be honest, I now see contracts as being similar to a health checkup: first, get a feel for the "permissions" part.

Many people find it troublesome, so they give unlimited authorization right away, and later forget about it.
When something actually goes wrong, they only realize it after checking the records...
That feeling is like staying up late and overexerting yourself; nothing happens normally, but once it crashes, it's hard to recover.

I understand revoking permissions as "locking the door before bed":
It doesn't guarantee you'll encounter a bad actor tonight, but leaving the door open just gives them an opportunity.
Especially with some old projects that later upgrade, change routers, or get front-end hijacked,
the biggest losers are often those wallets with unlimited permissions still lying around.

Recently, NFT royalties have been quite a heated topic,
everyone is discussing how to balance creator income and secondary liquidity,
but for ordinary users, the real "money deducted" on-chain isn't usually royalties,
it's the approve you casually click...
I'm not even sure when I might hit a landmine, so my habit is to revoke permissions after use,
or simply give small allowances to be more worry-free.