Coverage-based testing tries to touch everything a little; risk-based testing concentrates on what matters a lot. Under a deadline — the normal condition — the default you pick decides whether the bug you miss is the costly one or the trivial one.
A test strategy is a short set of project-specific decisions, not a generic thirty-page document. Scope, risk, levels, automation split, data, ownership, and what "done" means.
Not a purity contest — emulators for functional/UI/CI, real devices for performance, sensors, network, and sign-off. Decide per test whether the check needs real hardware.
Derive thresholds from user expectation, today's baseline, and business impact — set on p95/p99 with an error-rate gate, tiered by criticality — not a made-up 'under 2s'.