Androids are full of malware and who knows if his seed was leaked in some way. Even deleting the wallet might not remove all traces. The hacker might just wait for a deposit and then sweep all the funds.
He could flash his phone, insert an OTG with the wallet apps ready to be installed. Install the apps, generate new seeds, store it, and leave it. Uninstall the apps, reflash the phone and done. But this is inefficient and ineffective. Agree with the HW part, if the point is having a cold wallet, a phone is not the best choice.