The way they usually work is they give you some string and you sign it to prove you own the address.
Could a malicious air drop make a transaction sending all your BTC to them, and then you sign it, and then they broadcast it to the network?
Or is signing a message different than signing a transaction?
If you put your private keys in their form to qualify airdrop then it can hack your bitcoin. Not all airdrops are safe, some there requires you to download a wallet in order to receive your token, but it is a malicious software so be aware don't be fool.
It happens but most of the time with newbies who are not well aware with how things are going to harm them without knowing it, people who are just wanted to earn without studying and without any concerns with the securities of their assets, airdrops can be good but also can do bad things when hackers able to catch your keys and sucks everything inside your wallet.