do not forget that for many people a cold wallet will have a number of drawbacks. For example, like losing a key or transmitting it to other users, viruses, etc.
I think you might be confused as to what a cold wallet is. A cold wallet is completely disconnected from the internet, such as a paper wallet or airgapped computer. As long as you don't do something stupid, your private keys will never touch a device with an internet connection, and therefore can never be transmitted to another user. Similarly, it is impossible for an airgapped computer to get a virus unless you transfer one to it via removable media such as CD or USB drive. The risks you talk about are risks of hot wallets, such as software mobile and desktop wallets.
It seems to me that online wallets are suitable for small amounts, most importantly time-tested.
The only thing that time has shown us is that given enough time, every exchange or web wallet gets hacked eventually. The risks you talk about above (keys being stolen, malware) are particular risks for online wallets, and they also introduce a number of risks which don't exist with other wallets, such as phishing pages/links/emails, accounts being hacked, the service itself being hacked, unannounced KYC requirements, accounts being locked or closed, the service shutting down or scamming, etc.
2fa and other delights must be used
If you are going to use a web wallet (I wouldn't recommend it), then you absolutely should be using 2FA, but doing so does not make you 100% safe by any means. It lowers the risk of losing your coins if your account is hacked, but you are still just as vulnerable to all the other risks I just listed above.