There were no hardware wallets in the days of MtGox, which meant that it was extremely hard to secure Bitcoins. It got easier since then, and many people learned from MtGox (though many people haven't). Also companies take bigger care of securing their cold wallets.
I would never recommend BitFinex to anyone though (GDAX and BitStamp have VC money / long history)
What world are you living in? Software wallets are and always will be vulnerable to incalculable numbers of side-channel attacks that they cannot possibly defend against. It is intrinsic to running on a general purpose OS. Hardware wallets are the only method of having anything anywhere _near_ security here.
"The new firmware 1.3.3 is immune against this attack since it (1) requires a PIN to compute the public key and (2) uses branch-free computations for deriving the public key from the private key."
The browser with its plethora of extensions is arguably even worse than an operating system, and yet people keep using online banking and don't get hacked 24/7. Software can be reasonably secure and is basically as vulnerable as the human that's using it.
If you insist that one should err on the side of being paranoid when handling money, you can argue that hardware wallets are secure iff you manufacture your own hardware.
Want true security without going into hardware manufacturing?
Pick a private key and write it down on a piece of paper (ideally you'd do it in your head) along with the corresponding public key. Then send bitcoin to an address that's controlled by the keypair you just created. If you did all the calculations in your head while wearing a tin-foil hat your bitcoin should be reasonably secure.
Seriously: a box of dice, some graph paper, and a little patience goes a long way in terms of security.
Your threat model almost certainly is one in which writing down a strongly-generated password is much more secure than anything else, if you take efforts to secure the written copy.
I feel like passwords are some kind of magical Wild West of crypto, where everyone has rolled their own and the "best practice" recommendations are often nonsense that ignores threat modeling and I'm just taking crazy pills for thinking we should treat it like other kinds of crypto where users only apply standard methods with verified entropy generation.
