hot wallets for the first step is perfectly fine

there are bitcoin signing devices for around 50$ now tho, so no excuses there if u have to secure a larger amount of bitcoin and you understand why it is important to keep your keys offline (highly, highly recommended)

it also doesnt end with just cold storage, there are more levels to consider, where at least privacy can increase with every step:

0. on an exchange (IOU "bitcoin")

1. hot wallet (no offline key)

3. cold storage, offline key

4. run a node, w a dedicated device

5. roll your own dice for key generation

6. multisig

7. coinjoin/mix

8. inheritance planning