Withdraw after each order
Do not keep a running balance on the storefront. Sized-to-order only.
Every deposit on Nexus sits behind 2 of 3 multisig, so buyer coin is not custodially held by the operator. But after an order releases, the buyer balance appears on the wallet panel as regular balance, not as multisig-locked. That balance is custodially held until the buyer withdraws.
Do not keep a balance on the storefront across orders. Withdraw after each release. The wallet balance you should keep is either zero (nothing pending) or exactly the amount for the next order plus a small buffer for network fees.
The reason is not that Nexus is likely to steal your balance (multisig closes the largest attack vectors, and Nexus has run two years without incident). The reason is that a balance you can only recover from the storefront is a balance you lose if anything happens to the storefront. Withdraw promptly. Store coin in wallets under your own keys.
Why the balance is the exposure
Escrow protects money attached to an open order and nothing else. A working balance held between orders sits in no contract, requires no signatures to move and is exposed to whatever happens to the platform. That is the money most commonly lost, and losing it does not require anything dramatic to happen. Deposit close to what the order needs, withdraw the remainder, and the question of what a platform might do stops being able to cost you much.
The cost of moving money too often
Each transfer pays its own network fee, and on a congested chain that is not trivial. Funding once for what you intend to spend beats several small top ups, and withdrawing once beats withdrawing in pieces. The saving is unremarkable per transaction and noticeable across a few months.