Lately I've been looking into IBC / message passing and other cross-chain stuff. To put it simply, when you click "cross-chain," you're actually buying a set of trust: whether the light client / verification logic on the main chain is trustworthy, whether the consensus on the other chain is stable, whether the relayer will slack off, and whether the critical "proof" and timeout mechanisms are correctly implemented... As for bridges, it's more straightforward; often what you trust is a set of multi-signature / oracle / escrow rules, and when something goes wrong, you can only accept it.

Compared to that, I'm now more concerned about "who can single-handedly change the state" and "who is responsible for compensation if something goes wrong," rather than how decentralized the publicity claims are.
By the way, recently there's been a heated debate over NFT royalties. I understand creators, but forcibly deducting fees indeed makes secondary sales harder to move, and ultimately, it comes down to who holds the execution power.
Anyway, I no longer believe that "cross-chain = frictionless"; I treat every bridge transfer as a small risk control measure.