I don't say Linux or MacOS is safer than Windows, but still Windows has the largest market share
and is therefore very relevant and interesting for malware creators. The more users you can attack, the better. It's a rather simple logic. And because there are significantly less Linux users to attack, it's not very likely that malware will focus on a niche user group. Therefore a Linux setup is very likely a more safer one to handle your crypto stuff.
Same applies likely to MacOS users, though they may be a bit more interesting to target because they might have more money to afford the expensive Fruit gear. Frankly, I don't know if this assumption really holds water.
Why people infect their devices where they handle their crypto wallets? Likely because they use their daily driver also to handle their wallets. Not a particularly safe setup, to be honest.
Likely also some people are reckless and use cracked Windows software, games or whatnotelse on their devices where they handle their wallets. Definitely not a safe setup for sure if you run cracks or warez from shady sources.
A decent hardware wallet protects your private keys from malware. It only protects your transactions when you carefully verify ALL details of a transaction on the independant display of the hardware wallet BEFORE you sign and later broadcast the transaction. NEVER skip to check all details of your transaction carefully before you sign it. This avoids that malware replaces output addresses to ones that you didn't chose to send coins to.
