The alternative is to use it as 1 daily driver key for say a 2/3 multisig, where the third wallet could live peacefully on disks as a VM worst case.

That way I’d get the security of a hardware wallet AND multisig, without the rug pull risk :-)