Safety come first, understand the online - Learn it here
1(a) First, you need to understand how does hacking work. Hacking needed 3 things which is Access, Inject and Control (For Trojan) and Access, Steal and Control (For basic scamming technique ran by hackers).
Turning off WiFi (Wireless local connection to access internet (Global Network). Pronunciation: /ˈwaɪ.faɪ/) help prevent Trojan requirements (Access) if it was Online instead Offline. Why? Because trojan is a hacking technique that disguised itself to attack the target (Source: National Institute of Standards and Technology (NIST). https://csrc.nist.gov/glossary/term/trojan_horse)
and needed WiFi access (Or offline, commonly used when controlling server) to control the target which is called RAT (Remote Access Trojan). Trojan is not only about controlling, because its point was to disguised itself to fool the target into thinking its a safe file while it was masked.
turning off WiFi DOES NOT prevent Offline trojan nor Online (source: Trend Micro. Link: https://www.trendmicro.com/en_gb/what-is/cyber-attack/trojan-horse.html)and Offline malware and even some smart online RAT can turn it off itself and wait for WiFi or connectivity to the online world to work (Source: Wizard Cyber. Link: https://wizardcyber.com/learning-hub/learning-post/what-is-a-remote-access-trojan/). And it usually does NOT prevent bank stealing, identity stealing and more.
1(b) According to Google Overview. Simply turning off WiFi to prevent RAT (Remote Access Trojan) DOES NOT helping us at all because this is modern era ("the infected client software sits quietly on the victim's computer, survives reboots, and continuously tries to call out to the attacker's server until a network connection becomes available". Source: Google Ai Conversation model Gemini). Even though it deactivate the RAT itself, it does NOT burn it or stop it forever. Instead, good way about turning off WiFi is when you turn the WiFi off and then use a trusted source, tutorial or an fixer to delete the RAT itself but you can use your own laptop or PCand Artificial Intelligence to investigate, find and delete RAT itself.
2(a) TO really prevent, it some organization such as Cybersecurity and Infrastructure Security Agency (CISA), National Institute of Standards and Technology (NIST) and National Cyber Security Centre (NCSC), We should keep all operating systems, browsers and apps updated to fix security bugs, downloading software only from official vetted stores, and keeping built-in antivirus and firewalls activate (Source: UK National Cyber Security Center (NCSC) Device Protection Guide. Link: https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/protecting-your-devices).
This also included downloading only app from trusted source and have the trust of community or verified by Play store, google, NCSC and more.
2(b) Avoiding pirated files and suspicious attachments: RATs commonly hide inside seemingly legitimate files or unverified downloads, recommending updated security software and avoiding unverified links or downloads such as pirated files and free / modded / unlimited-type game (Source: Kaspersky Remote Access Trojan Guide. Link: https://www.kaspersky.com/resource-center/definitions/what-is-a-rat-remote-access-trojan).
People know are more focused on pirated files such as free GTA game, Minecraft Free Download and more and may make you weak and have the risk of identity stolen or even injected RAT (Source: Eshan Host - Piracy. Link: https://eshanhost.web.app/context/0003/).
2(c) Adding Multi-Factor Authentication (MFA) or 2-Factor Authentication (2FA) and Password Managers is the best way to prevent any stealing according to NCSC (Source: NCSC Top Tips for Staying Secure Online. Link: https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online)
because MFA or 2FA notices YOU when it require like OTP Code, authentication code and more (Source: UK National Cyber Security Centre (NCSC) 2-Step Verification Guide. Link: https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/activate-2-step-verification-on-your-email).
Even though the 2FA uses TOTP Method (Authenticator Apps such as Google Authenticator or Authy), Hacker cannot do anything because the TOTP is inside your apps. Ergo, the hacker cannot see the 6-digit codes inside the app required by the website unless the hacker itself already have RAT inside your phone which make them sea the 6-digit codes. But dont be so happy because hacker can bypass TOTP without touching your phone via Real-Time Phishing, Session Cookie Theft and Social Engineering / Scams.