Comparing wallet types in relation to security weakness:

Hardware wallet, paper wallet and wallets on airgapped devices are safest.
Desktop wallet is still safer because it is not used like phone, if you lose your phone you might lose you funds if compromised by hackers.
Then mobile wallets which is still better than web wallet
The weakest are web wallets.

No wallet will be safe if you do not protect your wallet.

About malware like Pegasus spyware, hardware wallet and wallet on airgapped devices would be resistant to spyware because the seed phrase and keys are completely offline, but the spyware can still spy your activities. But web, mobile and desktop wallets are not all resistant to malware. Protect yourself from malware.

You can start reading some of these topics: Good topics on security and privacy to help protect yourself from malware.

Lastly, know that cold wallet like hardware wallet and wallet on airgapped devices might not be resistant to clipboard and QR code malware. So, make sure the device used to operate your cold wallet is not having malware, also check and recheck the recipient address you are sending to for it not to have changed to a hacker's address.