> He cannot be sure his phone or device isn't compromised

all bets are off then. And by the way that might not matter as mobile phones can be compromised "over the wire" [!]

[!] https://en.wikipedia.org/wiki/Pegasus_(spyware)