Thank you.

Does this procedure expose my xpub to the wallet app? I assume so. I don't like the idea of an app on my untrustworthy phone holding all my wallet addresses and public keys. Am I being too paranoid? Any way to keep my xpub only within the cold card?