I once inherited a contract where a for-loop over an unbounded array of user addresses was used to distribute rewards—one malicious actor with a tiny balance could cause the entire distribution to hit the gas limit and lock all funds. Refactoring to a push-over-pull pattern was the only fix. That silent denial-of-service trap taught me to never trust that storage arrays will stay small.