...
If you follow the rules, you will be safe, especially when you download the wallet from the official source and not a clone one. But one thing which makes other wallets safer from mobile phone wallets is when you have your wallet connected to a device you use on a daily basis to shuffle round the internet, you can never be too sure of which link you are clicking on from search which you don't plan to, especially when one is not using an ad blocker; you can get yourself exposed unknowingly.
Back when I didn't have hardware wallet, I used coinomi to store my funds, and to keep it safe, I would use this app called 'Net Guard' — where you can individually block access of Internet to apps and I would only allow access when using it and never used it over unsecured WiFi network.
Secondly, during creation of wallet or restoring wallet (when changing phone), I would disable mobile data/wifi and then paste the recovery phrase (coinomi allowed pasting recovery phrase offline and fetching addresses from same, other wallet apps I've come across require Internet access for some reason), then copy something else random after pasting seed phrase so clipboard doesn't retain my seed phrase.
I don't know how good that was, but must have worked out well, as funds were never drained.
I instinctively stay away from shady stuff, can't be fooled there knowingly.