Is there anything inherently insecure about using a dedicated Android phone as a "hardware wallet"?
A dedicated phone implies:
a clean ROM without gapps, e.g. GrapheneOS, Lineage OS without root, etc
full phone encryption enabled
no other apps installed apart from a wallet app such as Mycelium, Breadwallet, GreenBits, Samurai, etc.
I realize that the majority of Android phones don't have (yet) a secure element like trezor or ledger devices, and that system apps might have unlimited privileges, but what are the main issues or specific attack vectors to be aware of in such a setup as compared to dedicated hardware wallets?
My understanding is that physical access to a trezor or ledger is useless if the attackers don't have the pin or passphrase and that these devices are built in such a way as to make hardware extraction of private keys impossible or financially unfeasible.
Is a comparable level of security achievable with an Android device with full phone encryption?
Also, does setting a pin code in a software Android wallet mean that the private keys are actually going to be encrypted or is the pin just for opening the UI?
Any data on which wallet apps protect the keys in a way which makes their extraction impossible without the pin code/fingerprint?