I don’t know the details but this feels like such a specific attack vector. Most malware targets the easiest and most common payload delivery mechanism as possible. Having someone connected via hotspot and piggybacking ontop of a specific workflow such as Shizuku just seems super unlikely. Could absolutely be wrong about this though, just my gut feel