The way they usually work is they give you some string and you sign it to prove you own the address.
Could a malicious air drop make a transaction sending all your BTC to them, and then you sign it, and then they broadcast it to the network?
Or is signing a message different than signing a transaction?
No, that will not happen. Bitcoin transactions will not require a signature, the word needs private key or key store to log in to the wallet and start trading.
they are not important about signature forms, they are important about the personal information you provide, especially the passport.