It's way safer and less complex than you would expect. Most staking contracts are a copy-paste of two basic staking contracts (from synthetix and sushiswap), so it's enough to do a text diff and see what was changed, which is trivial. For more complex contracts that do something more, funds at risk are the best bug bounty there is - in the current environment if something had >$10M for a month and wasn't hacked, it most likely can't be trivially hacked. Bzrx, the single most incompetent defi platform, was hacked just two weeks after a relaunch for $8M - most likely someone was waiting from the start for it to get enough funds to make the hack worthwhile. Almost no hacks happened during the entire yield farming craze.

Key word trivially - some contracts are custodial, so if someone hacked the owners (or they turned out to be scammers) funds could be stolen, which arguably has a reverse Lindy effect in the beginning. Fortunately people are starting to demand at least timelocks and/or multisigs. Another risk is how well liquidations function during a price crash, for protocols that need them.

The current risk premium was and still is absurdly overestimated, but that was a good thing (for me) as without it three or even four digit APYs wouldn't last a day, but thanks to the unwarranted risk premium they lasted about 2 months. During the short peak three weeks ago it was possible to make even ~8% per day (on millions of dollars - good liquidity), completely risk free (trivial staking contracts). The great crypto bullrun of 2020 already happened and few outside of ethereum even noticed.

You will see billions flow into defi on ethereum as others realize the real level of risk too (which guarantees those astronomical returns are never going to return - but even 10% apy on dollars is good in the current environment).