The way they usually work is they give you some string and you sign it to prove you own the address.
Could a malicious air drop make a transaction sending all your BTC to them, and then you sign it, and then they broadcast it to the network?
Or is signing a message different than signing a transaction?
They not get your fund as long you not go to their link which its phishing site so always be careful when we participate to airdrop check the site first before fill up anything and if you feel that there a suspicious in that airdrop better to avoid it. There's a lot of airdrop that legit and don't focus to airdrop there's a lot of ways to earn in crypto like bounty, social media campaigns and trading.