The more you learn about Bitcoin security, the more you become a SeedSigner (or more broadly a general-purpose air-gapped computer) maximalist: generate the seed entirely offline with dice or other analog entropy, and ideally never load it onto a device that remembers or stores it.

Even when you spend, use a stateless device so the seed only exists temporarily in RAM and is wiped on power-off. Add a strong dice-generated passphrase and/or a geographically distributed multi-sig quorum, and you have ironclad security for your stack.