Handing it over yourself is more common than being hacked. The failures that actually happen.
Creating a personal wallet gives you a recovery phrase of twelve to twenty-four words. That phrase is not a password; it is the wallet. Anyone who knows it can restore the wallet anywhere and take what is in it. Lose it, and there is nobody who can return it to you.
Most losses come not from sophisticated attacks but from users entering their recovery phrase into a fake site or application. Prompts such as 'your wallet needs resynchronising' or 'verify to claim your airdrop' are typical. Outside a legitimate wallet restore, there is essentially no reason to enter the phrase anywhere.
Mistyping an address, or sending over an unsupported network, simply loses the funds. There is no bank to cancel or trace it. For large amounts, people send a very small test transfer first, confirm arrival, then send the rest. Copy addresses rather than transcribing them, and check the first and last few characters in case the pasted value was altered.
Connecting a wallet to a service grants that service permission to move your assets. A granted permission does not expire on its own, so if the service is later compromised, that standing permission can be used to drain funds. Revoking approvals for connections you no longer use is the safer habit.
Keeping everything in one wallet means a single incident ends it. Splitting a small everyday wallet from long-term storage, and keeping the latter on something not connected to the internet, is widely practised. Writing the recovery phrase on offline media such as paper or metal and keeping copies in separate places covers both loss and fire.
Each button runs this keyword on that search engine