Thanks, Baertram.
I'd been doing much the same, leaning towards preferring SecurePostHook, however lately I am finding myself taking more of a similar tact to what you describe, using ZO_PostHook where post hooking is needed unless it is something which touches any inventory (including character worn inventory) in any way. I feel I am still being pretty conservative, and SecurePostHook is there in case "insecure code" errors ever do pop up.