Disclaimer: I am not a lawyer and this is not legal advice. This is a reading of what the license text plainly says. For any real IP decision, consult a qualified patent attorney.
I always thought of Apache-2.0 as the safe one, and as a user it is. Its Section 3 has every contributor grant you a patent license to make, use, and sell the work. That means a contributor cannot turn around and sue you for using their code to practice their patent. They licensed it to you when they contributed. As a consumer of Apache-licensed code, that is pure protection, and it is why the license sits in the safe column.
But a grant has two ends, and I had only ever looked at one of them.
When you publish your own code under Apache-2.0, you are the contributor now. You are the one making that grant. By the plain text, releasing under Apache-2.0 means you are handing everyone a royalty-free patent license for whatever patents your implementation practices. If a method you intend to protect is embodied in the code you just pushed, you have granted a license to it to everyone who uses that code. That is the price of the Apache grant, and it cuts both ways. Worth knowing before you push an Apache-2.0 release of something you plan to patent.
The retaliation clause is the softer part, and this is the contrast that made it click for me. If you sue claiming the Apache-licensed work infringes your patents, your license to that work terminates. You lose the right to use and distribute that project. You do not lose your patents. You can still enforce them against other code. That is annoying but survivable, which is exactly what makes it different from the GPL v3 case, where the equivalent move can leave you distributing unlicensed code and standing in as an infringer.
So the rule I carry: love Apache-2.0 as a user, and respect it as an author. The grant you receive is the grant you give. Before you open-source the thing you mean to protect, read Section 3 with yourself cast as the contributor.
Full writeup: The GPL v3 patent trap nobody checks