Since it's a native app on your phone, the private key would only be stored on your phone. It's web clients where the risk can be, because the private key can be intercepted if it's stored on their servers.

So the scenario to be cautious is a web client asking for your private key without an option to use the nos2x or other extension to authenticate.