Select the address with mouse, then click-and-drag it to where you want to paste it.
Once your OS is compromised, you can't trust anything anymore. Although I haven't seen this happen yet, I can imagine at some point a compromised OS can make your wallet send funds to an address different than the address shown on your screen. A hardware wallet prevents this, assuming you thoroughly check the address on your hardware wallet before sending funds.