If that’s what’s available I will argue it’s still a better option, because it’s isolated. You can make transactions with QR codes and do nothing with the device except run the wallet app, which removes most options for an attacker, including some that could work on a hardware wallet (ie. more complex transactions where it doesn’t display enough info about what is happening to know not to approve it).