Well, she was actually committing a crime. I'm just buying and holding my BTC in OWNR wallet and it's not illegal in my country, so I'll be fine.
For holding you should have a dedicated air-gapped machine that's fully encrypted and using only official wallet software for accessing it - in terms of BTC - Bitcoin Core wallet.
If you use different software or hold in a hot wallet then sooner or later you'll get hacked.
Even developers get hacked from time to time... your main wallet (and seed phrases) should never touch the Internet - consider it compromised if it did.
It should be generated on air-gapped machine and kept there, make backups on encrypted drives with good enough password that you can remember (you should never write it down) and that will be hard to brute-force.
Never store your seed-phrase in plain-text, encrypt it and then print it.
The more you know about computers, the more you realize it's impossible to protect your Internet connected machine from threats.