You must download the official metamask wallet and bookmark the downloading page and don't just search on the web if you're downloading if you mostly uninstall it from time to time. In other cases, if you've been a victim of a phishing website, think of how it happened, how did you landed to that phishing site.
Always check and verify if it's the legit and official metamask wallet.
You are right. I messed up.
Other than that, is there anything else than can be done to prevent the tokens from being stolen?
Can anything be done about it?
If they could modify the code of the smart contract that would be absolutely helpful. Do you know any case where that actually happened?
How would that be done?