The simple (and I believe correct) answer is: use hardened keys everywhere except where a need for watching-only wallets is perceived, e.g. below the "account" level. A watching only-wallet in this scenario will be able to both create new addresses, and monitor the balance of an account.
Hence BIP-44's path is:
m/44'/0'/account'/change/index
The clear result is that each account's xpub must be exported separately from a cold wall for import into a watching-only wallet.
Almost every wallet I've looked at uses this method (the exception being Wallet32 for Android prior to v0.2.5 released May 15 2014). Reference: this bitcointalk post, which links to this spreadsheet.
edited to add: Also of some relevance is the level at which an xpub is exported. Almost every wallet which supports xpub exports does so at the account level (same reference as above), which includes both the external and internal (change) chains of a single account. (The exception is MyCelium for iOS, however this is considered a bug by the MyCelium devs.)