A bridge's security isn't the chains it connects. It's the cheapest way to forge one message — usually a threshold of keys guarding far more money than they're worth.
In March 2022 an attacker took $625 million out of the Ronin bridge with no clever exploit at all. They simply had five of nine validator signing keys — four from a compromised operator, and one from a DAO that had granted signing permission months earlier and never revoked it. Nobody noticed for six days.
— Educational, not financial advice.