I seem to have tacitly assumed that on-chain transactions are absolutely safe, although theoretically it takes 6 blocks to confirm.
There's no standard number that insures absolute safety, such as 6, either. Every transaction is reversible, theoretically. If it was just confirmed, 1 block now, it requires less effort than one that's 100,000 blocks deep, but they're both reversible, with enough effort. The "6 blocks" is just a good tradeoff between time and security. Given that you own
40% of hashrate, you have 50.398% chances to reorg 6 blocks.
To go even deeper, cryptography isn't "absolutely secure" either. Theoretically you can find all private keys with bitcoin. Practically, it's impossible.
I don't feel transactions via Lightning have the same security risks as traditional on-chain, so there's no direct comparison.
From my experience, the significant risk with Lightning is human error. There are some good odds to mess things up with the software, especially if you're not a techie.