There are so many websites these days that require you to connect. I've been connecting other wallets with low balances to test things out, but there doesn't seem to be much information around on what is good practice here.
My big balances are secured by Ledger so I suppose I don't need to worry about the coins simply being stolen without my approval, but what if I connect the Ledger to approve some coins and it steals other coins or uses the approval for something else. Is any of this possible?
When should I not connect to a website?
You only need to disconnect from the platform after you are done using it. Don't leave it connected for too long especially if you don't visit it anymore. It's true that you need your confirmation, but that doesn't mean your wallet is safe from theft of coins in the Metamask wallet. As long as you hold the key there is no need to worry. And always pay attention to avoid platforms that ask you to enter the seed phase.