I've lost extended attributes of files on a number of systems because they aren't always included by default in file operations. I don't trust everything that could possibly write/update a file to preserve them--common 'safe' pattern is to rename as .bak and write new file contents without EA to original name. Nor do I trust myself from archiving without using the right options in a hurry.
Yes concerning. The possibility of losing them between filesystems is worrying too.
One rule of thumb is `mv` will keep the attributes by default (given similar filesystem) and everything else needs tweaking/extra args. There's a section on it over here:
https://wiki.archlinux.org/title/Extended_attributes#Preserv...
The system call to read these attributes is getxattr(), for anyone curious.
Eg: one could piggy-back an entirely new file onto an existing file (it might have to be text encoded?).
It looks like the kernel might impose a limit of 64KiB on a file's metadata, but that's still quite a lot of room for data smuggling...