Since Paul used the same seed phrases that are in his hot wallet, it totally defeats the purpose of having a hardware wallet. If Paul copies the same seed phrases, if his hot wallet gets compromised, others can access it. Further, if the hot wallet stores the private keys online, then if a hacker is able to hack into the database, the wallet can still be compromised. Further, if the hot wallet stores the private keys on the device, even though Paul deletes the hot wallet, hackers can recover the file from residual data and get the private keys (hence such data should ideally be erased and not deleted).

The right steps would have been to create a new wallet and write down the seed phrases in the piece of paper. Then he should transfer all of the assets in his hot wallet to the newly created wallet.