The way they usually work is they give you some string and you sign it to prove you own the address.
Could a malicious air drop make a transaction sending all your BTC to them, and then you sign it, and then they broadcast it to the network?
Or is signing a message different than signing a transaction?
Airdrops are meant to be safe because they entails simple tasks to create awareness about the project in different ways , but nowadays scammers have looked for ways to exploit it so as to scam participants. Any airdrop that asked for your private keys or tell you to sign a certain message by providing you with a link to follow is highly fraudulent. Also, any Airdrop asking you to send a certain amount of ETH or as the case maybe looks questionable too.