Recently, everyone has been watching the main public chain upgrade/maintenance and guessing whether the ecosystem will move after the event.

I instead go and check the project's GitHub and audit reports...
Honestly, when a newbie reads "credibility," I only look at three things:
Is the code being actively updated (not just a bunch of commits overnight),
Does the audit report clearly state "what's not covered / risks still exist,"
And whether the upgrade permissions are multi-signature, who the signers are, if they can be changed, and if there's a time lock.
I admit I envy multi-signature setups a bit: the team’s process looks stable, while I can only pray at my keyboard that nothing big happens.
Anyway, while it's lively, I tend to avoid projects with opaque permissions and processes, so I can sleep more peacefully.