Since at least Windows 10, USB’s don’t autorun from the desktop. Maybe don’t stick it in during preboot if you wanna be super cautious. Just format it after plugging it in and you’re good.
Not unless your system is already infected with a simple background task that will autorun it. In the PC world we call it “Getting DP’d”. Look it up on Bing video search for more details.
Go through her installed apps in the settings and delete anything that says “Home” in the name, like “messenger Home”.
Check what the default home app is. It should be the standard Galaxy phone home app, nothing else, ever. You have to switch back to the default OneUI or whatever it’s called these days before you can uninstall the fake one.
Delete any app that doesn’t come from like the top 10 tech companies you know. Delete all emoji and keyboard apps.
Google every app you don’t know yourself and see if it’s legit or not.