Recently, someone has been watching large on-chain transfers and hot/cold wallet movements on exchanges, shouting "Smart money is coming" at every move.

I, on the other hand, stay calmer... Maybe it's because I'm used to first looking at the evidence: whether there are notes, whether it's an internal collection, whether the authorization traces are clean, and where the subsequent contract call links to.
Without seeing these, just looking at a large transfer is actually quite superficial.

As for how to balance between L2 and the mainnet, I personally keep it simple:
For everyday small interactions, try to use L2 as much as possible, saving gas and keeping things smooth;
For long-term or permission-sensitive activities (like large amounts, critical authorizations, or things that are safer to stay on the mainnet), I’d rather pay a bit more gas on the mainnet, tighten the permissions, and revoke after use.
In short, if you want both good experience and security, you need to take an extra "step" of "checking"; otherwise, cheap gas might end up being the most expensive tuition.
That’s all for now.