Could someone give clarity on how spam NFTs can actually compromise your wallet?

I've heard a lot of people warn not to touch any scam NFTs in your wallet (i.e. transferring them), and while I understand this is generally safe practice, could someone provide insight on how these potentially dangerous smart contracts might compromise you if you're already watching for the following:

1. Not clicking on the phishing links attached to the metadata
2. Watching for any amount that's being transferred other than the scam NFT
3. Checking for any fishy approvals that might have been granted after a transaction

Aside from not entering your seed phrase and not accidentally signing unlimited approvals to a malicious contract, I'm not aware of other ways your wallet could be compromised without your knowledge, so with that being said, could someone give an example of how transferring a malicious NFT has drained people's funds before?