Yeah, we can't always trust CEX to keep our funds safe since there are lots of hacks for CEX in crypto history and not every exchange in crypto industries has terms that our funds are backed by the exchange 100%. So holding our funds in a hardware wallet is always the best option or if we don't have money to buy a hardware wallet we can always use wallets like metamask and others to keep our funds as long as we don't get tricked by scammers.
First. A wallet has to be non custodial.
Second. Private key and seed phrase should be protected as much as possible so no one except you have access to it.
Third. Any interaction with a wallet should be as safe as possible: clear PC is good even if to use a cold wallet. No connections to any online projects with a wallet you hold your main balance on. Use a second address with small amount just for such purposes.
You are never 100% safe, but you can try to be as safe as it reasonably possible. Being watchful is a part of investing and holding.