Depends on how much work you want to do.

If you are a DIY person seedsigner is awesome. Stamp your seed words into steel and store in geographically distributed secure locations. Use a coordinator wallet like sparrow or specter to generate addresses and spend. Always verify the developer signatures for your binaries. Use coin control. I like this option because it is very cost effective and it teaches you all about bitcoin.

If you want a foolproof setup get a service like casa or bitkey. They have tested all the flows and smoothed over the rough spots. They host a cloud key for you and put a hot key on your phone's secure element. Get hardware wallet(s) from different manufacturers. Order direct from manufacturer. Store in geographically distributed locations. Really nice tradeoff between cost, convenience, and security.

For ultimate security do not use any hardware or software. Use codex32 to hand generate a key pair and SSS key shards. Never enter the privkey into a computer. Store privkey shards in geographically distributed secure locations. Set up a watch only wallet with the pubkey to generate receive addresses. Never spend from it. It's a piggy bank, break in case of emergency.