That just moves the problem, what happens if I put a piece of paper between them? Unless they don’t interact with anything they still face the same problem.

You can nixos-rebuild her, you have the technology.

All devices launching with Android 10 and higher are required to use file-based encryption.

To use the AOSP implementation of FBE securely, a device needs to meet the following dependencies:

• Kernel Support for Ext4 encryption or F2FS encryption.

• Keymaster Support with HAL version 1.0 or higher. There is no support for Keymaster 0.3 as that does not provide the necessary capabilities or assure sufficient protection for encryption keys.   
  

• Keymaster/Keystore and Gatekeeper must be implemented in a Trusted Execution Environment (TEE) to provide protection for the DE keys so that an unauthorized OS (custom OS flashed onto the device) cannot simply request the DE keys.   
  

• Hardware Root of Trust and Verified Boot bound to the Keymaster initialization is required to ensure that DE keys are not accessible by an unauthorized operating system.

https://source.android.com/docs/security/features/encryption/file-based?hl=en