quick question:
how come etherscan connect wallet never prompts you to sign a message?
is this secure?

any action you'd take through etherscan is either an onchain tx, or just reading public chain data. so anything that needs the auth happens in a tx.

signing messages is generally for apps that don't do anything onchain at all, but still require a user account.

e.g. i need to sign a message to save or adjust UI settings.

and yes, you can verify ownership prior to onchain txs, but since txs can be submitted without using a frontend it doesn't make tons of sense

ahhh I see
so signing messages is purely for a middle ground (verify this address is yours before you actually do an onchain txn)