Rollups are described as inheriting the security of the chain beneath them. The phrase covers several distinct properties, and different designs inherit different subsets of them.
Execution moves off, settlement stays on
A rollup runs transactions on its own infrastructure, producing a new state and a compressed record of what happened.
It then posts that record to the base layer along with a commitment to the resulting state, which is what makes the result checkable.
The base layer does not re-execute the transactions. It stores the evidence and adjudicates disputes about whether the claimed result was correct.
Data availability is the load-bearing part
Without the transaction data being published, nobody can reconstruct the rollup's state or demonstrate that a claimed result was wrong.
Posting that data to the base layer is what allows anyone to rebuild the rollup independently of its operator.
Designs that post data elsewhere to save cost are making a real trade, since the property they give up is the one that lets users exit without permission.
Fraud proofs and validity proofs differ in timing
One approach assumes the posted result is correct and allows a window in which anyone can submit a proof that it is not.
The other submits a cryptographic proof of correctness with every batch, so no window is needed and the result is verified immediately.
The first requires at least one honest party to be watching and able to submit a challenge; the second requires no one to be watching at all.
Sequencers are a separate trust question
Most rollups run a single operator that orders transactions, which gives that operator the ability to censor or to reorder for profit.
This does not let it steal funds, since invalid state transitions would be rejected, and it does affect who gets included and in what order.
Forced inclusion mechanisms let users submit transactions through the base layer directly when the operator refuses, which bounds the censorship rather than preventing it.
Upgrade keys are the practical exception
Many rollups retain an administrative ability to upgrade their contracts, often held by a small group with an emergency override.
That key can in principle change the rules governing withdrawals, which is a stronger power than anything the proof system contemplates.
Assessing what a rollup inherits therefore means reading its contracts and its governance rather than its category, because the label describes the intended design and not necessarily the current state.