Why wouldn't you keep your money on an entirely separate device? Even a cheap one? Why take that risk at all. That and using cold storage or 2FA.