I could recommend Trezor to someone with a note to additionally protect their account with a passphrase considering the irreparable vulnerability that allows anyone who has physical access to the device to extract the seed very easily
Or even better, get that new Trezor Safe 3 that has secure element.
That is one of the options, but the secure element is not something to rely too much on - because Ledger HW also has it, and in the end it turns out that the most sensitive data can still be extracted and shared with third parties. A properly made cold wallet or something like a Passport is still the level of storage that people should be directed to, especially those who want to securely store much larger values than a few hundred $ worth of altcoins.