A wallet that splits one key between a laptop and a phone is still a plain EOA, so the phone gets permits and EIP-7702 authorizations, not only transfers. Malware on the laptop will ask for those instead. The phone has to decode both, and allow 7702 only for reviewed delegates. https://ethereum-magicians.org/t/30364