>takes your phone or laptop to another room, the safe bet is to consider that device compromised if it’s brought back later, and to immediately procure new devices in-region, if possible
Isn't an easy solution to this is to have your "laptop" just have a generic OS install, but have your real machine a bootable USB or SD?