Could a malicious air drop make a transaction sending all your BTC to them, and then you sign it, and then they broadcast it to the network?
Or is signing a message different than signing a transaction?
The mechanism for signing messages is different from the mechanism for signing transactions on the network, so you have nothing to worry about. However, in any case, be careful with any of your online activities. Why is it necessary to confirm for airdrop that this is your wallet? I don’t see the point in this, so I would not participate in the airdrop where wallet confirmation is required.