It is a popular misconception that the use of metamask  automatically implies a reduced  threat to  ETH saving.  The safest way to do that would be to use  MEW confined in air-gaped computer which allows to sign both ETH and   ERC20  transactions. Later, those trx can be send  via any online services. Forum has readings of some of those options.