Is our hardware wallet safe if the PC or Mac has 3rd party apps?
Typically, the signing is done on the device and the private keys never reach the computer. This means that the computer can never generate and sign transactions on its own
A wallet like Trezor (T) shows the destination address from its screen so that you press one of the buttons on the device itself. This makes it impossible for the computer to make the device sign a stealing transaction, because you would see that the destination address is not your intended recipient.
I would use Trezor T with any online computer.