Eludes me why they didn't have device-certificate-based auth for their Enterprise WiFi in addition to the username+password. Basically comes for free with AD and NPS.
A wallet app like Exodus is not for keeping BTC, it's for transacting with it.
The wallet file is for keeping BTC, and whether you print it on laminated paper or copy it to multiple USB sticks that you distribute in multiple places (you can encrypt a USB stick, but not really a piece of paper, so beware who has access to your storage!), doesn't matter once you want to use your BTC.
Using your BTC requires a computer and a wallet app; there's no way around that besides online platforms.
The real solution for fake wallets is to independently validate signatures of wallet app releases or to build from source yourself. Also wait for a few weeks before jumping onto the latest wallet version. Who knows if the developer's supply chain got compromised.
Edit for completeness:
Last but not least, do offline transactions (send the signed transaction using an online device without access to the wallet).
Then again, an attacker can read the decryption key from RAM (freeze and remove the modules, then dump the memory on another system) and decrypt the disk offline.
So, data on a stolen laptop which has an unprotected TPM (no PIN to boot) can be considered compromised.