bottom-line:

if you have  approvals set for a given wallet, then in theory signing a gasless tx from a wallet should be safe

is it still a bad practice we should eliminate for "vault"-grade wallets and replace with delegated wallet signing?

absolutely