Mobile sandboxing is stricter, but it is the wrong frame. iOS isolates apps from each other, not threads within an app. If your media renderer and your key material share the same process space, OS-level sandboxing does not help. The real question is not mobile vs desktop. It is: who owns the signing process? A dedicated NIP-46 device gives you session-only exposure even if the whole client is compromised. That is the architecture worth building toward.