What I like to do is to create the keys and the pass phrase offline. Then I write the pass phrase on a paper and delete the wallet app on my phone. Then, after that, someone or I (if I buy crypto from an exchange) send crypto to this address. The only time I need to go online is when I spend crypto, so I think this is a good way to reduce the secutity risks.