Those are good warnings.  I am very nervous about mobile "anything" for absolute security.  I know it isn't necessary, but I prefer to setup a Trezor on a laptop first.  Then you use it with a mobile (e.g. MyCelium), however the mobile software never sees the private keys so it couldn't put them in the cloud if it wanted to.  Frankly, I personally don't do this, but I helped setup this configuration for a buddy.  His transactions are very small but its simple and safe this way.

Or just don't use mobile wallets entirely. Has worked for years so far with no problem and also utilizing cold storage.

Op said "Larger sums should be locked away in cold storage, offline, somewhere secure."

I don't use a mobile wallet. I barely use a mobile. But if I did, this post is clear info I would like to see.
Thanks OP.

Nobody should keep bigger amounts of Bitcoin on devices connected to the Internet. This holds true for PC's but even more for mobile phones, since the wallet software available for these devices is less secure (i.e. not fully validating, new apps).

It should be best practice to store all funds that are not used for daily purchases entirely offline - for example by using paper wallets. Mobile Bitcoin wallets should be used like ordinary hard cash wallets: The amount stored in them should be so small that it can be afforded to be lost.

It's sad that many users are not paying enough attention to security when using Bitcoin. In contrast to money stored at banks, Bitcoins have no insurance against theft. So it's entirely up to the owner to ensure they are not stolen.

ya.ya.yo!

I think the issue is with Android itself. No one ever seems to give its overall security any thought. They just assume it's fine and press on.

Considering how much lucrative info is on the average phone these days there are going to be ever more attempts to gain nefarious entry into it.

And in this particular case the second problem is a 'feature' of the OS and it's exposing your data to google. I can't imagine their security is anything other than exemplary but you never know.

This is alarming because i only mobile wallet application. But have not encounter some issues so far. Dont download wallet from not trusted sites or any refferal site. I suggest, you must go to website of the wallet you want to have and dowload it from their website so you are surely safe from fake applications

Tha's good information and I very believe with that, because to this day I'm always found the fake apps are copying the original apps just to trap the users, maybe some people is not careful is they installing the apps and using that. especially for btc wallet apps and maybe that's looks like original apps.

in my android i only use mycelium, and don't know about the other wallet. i am really afraid about the other apps that i don't know and don't want to install it on my android. i hope that in android can be secure from malicious apps.

i remember when i was first time add 2FA on my PC, and suddenly in one day, i can not login into market exchanger account, and search how to solve this. from what i've read, better we install 2FA on our android, don't install it on the browser, especially chrome because in chrome, there are many add-on that we don't know is it safe to install or not. and after that, i change 2FA from browser into my androids, and i hope i don't have this experience again in future.

i had never care about this these type of security but now after seeing your post now i realising that these security advice should noted . but one another thing in my mind that can any app is at playstore that can steal or disclose our privacy and can hack our system .

Thanks for very useful security tips. There are lots of security issue coming up regarding android apps as what apps do inside is quite unknown to normal users. I have blockchain.info wallet and electrum mobile wallet downloaded from official account in google playstore, hope those are fine and also i don't install other useless apps and games.