The phrase “layer 2” is used loosely enough to cover systems with quite different properties. The useful distinction is not speed or cost but this: what does the system rely on the underlying chain for, and what does it ask you to trust separately?
The basic arrangement
A rollup executes transactions away from the main chain, then publishes enough information back to it that the result can be verified or challenged. Execution moves; verification stays. That is the whole idea, and everything else is a detail of how the verification works.
Publishing the data is not incidental — it is the part that makes the arrangement meaningful. If the transaction data is available on the underlying chain, anyone can reconstruct the state independently and dispute an incorrect claim. If it is not, they cannot, and the security story changes substantially.
Two approaches to proving the result
One approach assumes the published result is correct unless someone demonstrates otherwise within a challenge window. This is cheap in the common case, because most of the time nothing needs proving, but it requires that at least one honest party is watching and able to raise a challenge in time. The withdrawal delay users encounter is that window.
The other approach proves correctness cryptographically at the point of publication. There is no challenge period because there is nothing to challenge — the proof either verifies or it does not. The cost moves from waiting to computation.
Both inherit their base guarantee from the same place. Neither is meaningfully secure independent of the chain it settles to.
Where the real risk usually sits
It is rarely in the cryptography. It is in the surrounding machinery: who is permitted to publish results, whether an upgrade mechanism exists that could change the rules, and whether the party sequencing transactions can delay or reorder them.
Many systems run with a single sequencer for practical reasons. That is not automatically dangerous, but it is a concentration, and it is worth knowing whether an escape route exists for users if that party stops cooperating. A system with an honest answer to “what happens if the operator disappears” is in a different category from one without.
Reading the claims
Treat “secured by the base chain” as the beginning of a question rather than the end of one. Ask where the data goes, who can publish, what can be upgraded and by whom, and what a user can do unilaterally if things go wrong. Those four answers describe the actual trust model more accurately than any label.
Our guide to layer 1 versus layer 2 covers the landscape, and what Ethereum is gives the context for where most of this work happens. Not financial advice.