I used to have my bankroll split between various sites and my winning on MoneyBookers (called "Skrill" nowadays). Then I ended up keeping my bankroll mostly on one big site and withdrawing my winnings to my bank account.
A huge problem with splitting on different sites is that it's great while your clear bonuses (and reload bonuses) but besides that, it's kinda bad because the "points" / status you gain by playing are split on several sites. I'd say it's better to reach a higher status on a single site and hence get a bigger rakeback. Now of course if you find a fishpond, go for it! (CakePoker, when it came out, was a gigantic fish pond and I didn't care playing there with less rakeback because the games were very juicy: no trackers at first and then no trackers "easily" available [because they weren't allowed on Cake]).
Regarding cashing-out and re-depositing constantly: the thing is: it's a bit inconvenient to deposit "as you need" because it takes some time for the money to be credited.
Now regarding the amount you need to leave on the site depends on which limit you're playing and how many tables you're multi-tabling: if you're playing on only one table you don't need as much as if you're playing 12 tables simultaneously (you'd obviously need at least 12 times your buy-ins + x buy-ins to handle the variance).
Back in the days I had zero issue leaving a 4-digits sum on a big site. I don't anymore because I don't take the time to play that much anymore.
Now of course if you leave any amount of money on a poker site you should use 2FA (Two-Factor Authentication), which big sites like PokerStars do provide:
en.wikipedia.org/wiki/Multi-factor_authentication
Because the first and foremost risk is definitely not PokerStars going down but a virus / trojan / attacker gaining access to your account and stealing your money (I don't know: say by faking a heads-up match where you'd lose it all).
This advice is not only poker related: it is valid for many other sites. Many sites support the Google Authenticator 2FA (PokerStars has its own 2FA as far as I remember), for example...