0x is hardening its swap infrastructure around the contracts that hold users' token approvals. Its AllowanceHolder contract has been formally verified by @bailsecurity on the Certora Prover, mathematically proving the contract is correct — the same assurance used by Aave and Uniswap. Few other swap aggregators claim this level of verification.
Per the verification, approvals cannot outlive the transaction even against a hostile callee, an allowance is scoped to exactly one (operator, owner, token) and cannot be over-spent, and failed calls roll back atomically. bailsecurity has also confirmed it is currently conducting an audit for 0x, alongside the Immutable Settler contracts and audits by Trail of Bits, OpenZeppelin, Dedaub, and Ouroboros, plus 0x's SOC work, as part of a broader security posture for its swap infrastructure.