Recently, with the re-pledging and shared security systems being criticized as a "copycat," I'm not surprised. The higher the returns stack up, the easier it is for people to treat risks as background noise. To put it simply, there are three red lines for wallet security: don't touch the mnemonic phrase online, don't blindly click on signatures, and don't give unrestricted authorization.

You think you're just "claiming airdrops/subsidies," but in many cases, you're just handing over the keys.
If I had been less lucky with that "just this once" mindset, carefully checking what permissions are being approved in the signature, whether the authorization is indefinite, I might not have been so scared out of my wits by a phishing site. Anyway, now I’d rather earn a little less than wake up in the middle of the night to find my wallet emptied like a refrigerator.