55, amber can be denied network access so I find that secure. 46 would be cool if there was a hardware device like a ring I could just tap with another finger to approve, but I haven't seen that yet.
When you mentioned Amber login, did you mean login via NIP-55 (Android Signer Application) rather than NIP-46 (Nostr Remote Signing)? I believe Amber implements both NIP-55 and NIP-46.
Discussion
In the NIP-46 protocol, the signer that stores the nsec does not expose the nsec. It only receives signing requests, completes the signing, and then sends the result out.
nostr:note1zhvanadlce4fm2svryk9e3wvw97q066zlq27wn9lcjav3lau5klq8f4mwh
Yes, but how is it the signing done? Via network comms right? So if the signer requires network access to work, then the dev pushes malicious code to publish the nsec, there's nothing you can do about it. Whereas nip 55 I can box up the signer with 0 network access so even if malicious code is pushed, it can't be transmitted.