The way they usually work is they give you some string and you sign it to prove you own the address.
Could a malicious air drop make a transaction sending all your BTC to them, and then you sign it, and then they broadcast it to the network?
Or is signing a message different than signing a transaction?
Nope. You should stay away from airdrop that require your personal information and Private Key, then they can't steal anything from you. You will safe on blockchain if you keep your PK safety. Just participate airdrop that you have to fill out the wallet address.