You have a point, most non-airgapped wallets like Trezor/Ledger have already suffered scandals.
Do you think such non-airgapped devices have the same security as a software wallet?

I'd never keep 5 BTC or more in just one wallet, probably 70% of that amount I'd keep in an air-gapped hardware wallet or on an offline computer with encrypted Tails OS installed.
However, I still consider hardware wallets like Trezor to be more secure than software wallets connected to the internet.

For larger amounts, like the $500,000 you mentioned, I would either store it in an air-gapped hardware wallet and the rest on an offline computer running Tails OS.
~snip~

Thanks everyone for a great week / Payments are on the way. ^{[Exchange rate: 95,300]} 

How do we make sure, that this token looks "attractive" and not like a scam...?
~snip~

Beware of any email that urges immediate action and tells you you might face negative consequences. This is typically a sign that the email is malicious.

Check the "from" and " to" email addresses. If the " from" domain isn't the actual company or the "to" recipient is not you, the email is likely a scam.

Avoid clicking on links in the email. In the attack described by Johnson, the malicious site is hosted on a Google domain. However, Google would never send you a legal complaint and then direct you to the Google Sites domain. If you're in doubt, log into your Google account separately without clicking on any link and see if any messages or alerts are waiting for you.

Finally, run an online search for the content of the email. That can tell you if others have reported it as a scam or received a similar email.