Ledger's Donjon security lab proved that physical access to a powered-off Android phone is enough to extract wallet seed phrases.
