No body is entirely 100% a security guru until they are attacked and notice that they have a loophole they need to cover, but some have been able to upgrade and cover their little mistakes by just being very careful and taking corrections from those who fall victim to hacks and exploits. As days go by, that’s how we will have to expand our knowledge on security and make sure that we are not left behind; even the most once-known secured devices are now discovered to have security issues that raise concern.
Anytime a wallet is drained, if we retrace back to what happened, you will found out that there was a mistake from the end user. It's very easy to make a lot of mistakes that will cost you more when you use software wallet than when you use air gapped device. The only time you get drained using a hardware wallet is if your seed phrase is exposed or forget to encrypt the wallet, you have zero risk of exposure to the internet because you were never connected to the internet.
It's common practice to use an online device with software inside but if you are going to use one, make sure you are not keeping an entire money on the wallet. It takes less than a second for malware to drain your wallet. It takes few clicks on your system to get phish and taking everything from your wallet. If you can buy one hardware wallet, it's cheap but there are also some software wallet you can use, they are risky though. You never can tell where you may get I wrong.