If you're downloading it "from the cloud" every time, your compromised phone can keylog your password, and the attacker can then download your private key "from the cloud" himself.

Sure, not using your bitcoins anywhere is extremely secure. But lets be honest here: you need to move that private key around with you. The true security measure is to have two wallets, two private keys. Transfer money over to the wallet on your phone only for temporary measures. If it looks like you have had any funky transactions, get a new phone, and a new wallet.

Your "offline wallet" remains secure and encrypted at home. But you need to put some money on your phone somehow. The most secure way of doing that is just leaving it on the phone, and making sure that private key never touches the internet.