This is a risk which is present for every user of desktop or mobile wallet, seed is at one point shown to the user and in time user is write it down, this sensitive information may come into the wrong hands. This will only happen if the user's device is already infected with some bad thing, but it can happen at any time if user is dealing with seed in any risky manner.
Air-gapped device is good way to create wallet since seed will never be exposed online, and we can make watch-only wallet for online device without seed. An even simpler way to protect seed is hardware wallet, it is only shown on device and it is always protected by device Secure Element.