It depends on the workload. Observability and security workloads often keep months or years of data hot because investigations can reach back at any time, while transactional or session data is usually hot for hours or days. The right answer is whatever supports your latency SLA without forcing you to rehydrate archives during real work.