The way they usually work is they give you some string and you sign it to prove you own the address.
Could a malicious air drop make a transaction sending all your BTC to them, and then you sign it, and then they broadcast it to the network?
Or is signing a message different than signing a transaction?
Avoid any airdrop that asks you to do such. There is something not right about such an arrangement. It is insidious and may likely cause you regret. The most an airdrop can ask for is your wallet address where the crypto can be sent to, and not that you should sign it to prove ownership. BTW, airdrops aren't worth it anymore. Most coins given out this way always end up as shitcoins.