Yield aggregators with those "look really attractive APYs," I now mostly just treat them as display spaces... It's not that they necessarily have problems, but behind the scenes, there's a bunch of contract calls + route swapping + re-investment, and if any link in that chain has a small vulnerability, it's a big risk, especially since many of them are layered with various "counterparty" risks — like who's providing market making/lending services, who's covering liquidation risks. Honestly, what you're getting isn't pure interest, but a series of promises stacked together.

Recently, the practice of staking and sharing security has been criticized as "copy-paste," and I don't think that's entirely unfair: the more beautifully the yield stacking looks, the harder it is to see where the actual risk comes from. Anyway, my current approach is pretty simple: first, see which contract or pool the funds ultimately land in, who holds the permissions, and whether it can be paused or upgraded; if I don't understand it, I treat it like buying a lottery ticket — small position, don’t treat it as stable cash flow. Rolling my eyes, but life is more important.