The way they usually work is they give you some string and you sign it to prove you own the address.
Could a malicious air drop make a transaction sending all your BTC to them, and then you sign it, and then they broadcast it to the network?
Or is signing a message different than signing a transaction?
Airdrops are meant to be free and in no case whatsoever are you required to send anything to them. Also, when they asking for private information like signing of message which involves your keys, you need to be careful especially when they provide a link for you to access your wallet with. Most airdrops are fraudulent and one really needs to be careful with the way they go about it; the first step should be having a separate wallet for all that pertains to it.
Airdrop's goal is advertising, aimed at disseminating information about project tokens to potential investors and crypto market enthusiasts. Mostly Airdrops carry out projects that are only planning to enter the market and are not yet known to anyone. In this way, the organizers are trying to publicize the startup. However, they collect private information of the project participants, and it scares sometimes.