Wallet exploits are the greatest vulnerability for self-custody.

Seedsigner is now the way to go. Stateless low-tech PSBT minimizes the attack vectors coming in