I came across this nice article when I was learning about chai.money
I had no idea that I was implicitly giving permission to exchanges to sell all my ERC20 holdings of a token when the more secure pattern was to allow only a subset of tokens for sale at a time to prevent getting wiped out.