Definitely a hardware wallet since the device itself can be kept inside a deposit box or in a lock where only you can have access to its funds using your private keys.

To be honest, I am somehow guilty of this because I mostly kept my BTCs inside our local exchange and external wallet. While this may be relatively secured, there is always that possibility where these exchanges may be the subject of hacks and scams, like what happened to Mt. Gox way back. In addition, several exchanges (including Binance) had experienced some hacking which resulted to loss of BTCs into the wallet of some.