::
They are not at risk. As long as an attacker doesn’t have your seed phrase (which allows them to BECOME you), the only thing they can do is try to trick you into signing a transaction which benefits them.
When you talk about a malicious mint, what’s going on is that some scammer builds a website where you think you’re minting a thing, but instead you’re just signing a transaction hurting yourself instead. Sometimes this is just sending ETH, sometimes it’s sending a Bored Ape, and sometimes it’s calling setApproval on an entire collection of NFTs which can be especially devastating.
Some more info here ([https://www.ledger.com/academy/smart-contract-functions-essential-red-flags-to-know-about](https://www.ledger.com/academy/smart-contract-functions-essential-red-flags-to-know-about))
​
The thing to know to answer your question is that a transaction originating from account 1a has no more permissions to move assets from 1b than anyone else in the world does. There is no transaction you could be tricked into signing with 1a that compromises assets in 1b.
​
The only way for 1a and 1b to both become compromised is if an attacker obtains the seed phrase that generated both of those accounts.