--snip--
When should I not connect to a website?
Anything that doesn't have a public contract. The ones where you cannot see the "Read/ Write" contract part on etherscan.
Most scams happen not from the "Sign metamask" transaction with which you connect but from some links on the website itself that can install malware.
With the number of times people just blindly connect for airdrops, its a big flood of scams waiting to happen when someone will attack the whole ethereum community at the same time.
You have a ledger so no problems of exposing the private key so that is definitely a win.
Are you saying that when you connect with your Metamask wallet, Metamask is sharing your private keys with that website? I wish there was a tutorial on how Metamask works and a whitelist of safe dapps you can use.
I am a newbie and I get overwhelmed by web 3.0; this is too much to learn and too much lack of safety and clarity.