Exactly. Moreover, most of these online wallets are scams that appropriate your coins when you try to withdraw funds from your balance.

It should be noted that the smartphone is not a trusted device in general, but for Ethereum you can download from Google Play and install, for example, Cipher Browser, Toshi, Trust Wallet. These applications are safe and securely store the backup phrase or private keys in the Android's DATA folder. They also support iOS.