The basic rule of thumb is: "I'm not aware of all types of security exploits. I must protect against those I do know of and then I must be proactive!".

Now you can easily spot them! The rule is: if you see a Result it means that this function can throw an exception. And you even know its type in advance.

In other words: the controllers usually contain only routing and rendering code and dispatch instantly to a particular operation/activity class.

If it's behaviour that you can imagine needing to reuse among multiple components, or if it's something that you can imagine applying to an element inside an {#if ...} block (for example), then it probably belongs in an action. It it's something that 'belongs' to the component itself, rather than a specific element, then it's probably more of a lifecycle thing.

A simple rule of thumb: the name of the updated variable must appear on the left hand side of the assignment. For example this... const foo = obj.foo; foo.bar = 'baz';...won't update references to obj.foo.bar, unless you follow it up with obj = obj.

Could I get your intuition for why that rule of thumb applies to svelte components but not Javascript functions? I tend to make heavy use of let x = e when writing normal Javascript, as I do in most other languages (though unlambda is a notable exception). How is svelte different?

Most copyright experts recommend this rule of thumb -- when in doubt, assume a work is copyrighted and ask permission to use it.