With ready-made approvals, Power Automate records who made the decision, when and with what comment. The approver acts under their own work Microsoft 365 account, so there is no doubt about who clicked. With a custom card, you have to design this record yourself, for example as an entry in a SharePoint list.
After the decision, the card should change: instead of buttons, it should show “Approved, Anna Nowak, 14:32”. Teams lets you update a card that has already been sent using a separate action, and Outlook has a card refresh mechanism for this. As a result, nobody clicks twice and everyone can see the status.
Phones also require basic access rules. The administrator should require multi-factor authentication, meaning a code or confirmation in an app in addition to the password. It is also worth deciding what happens to access when an employee loses their phone or leaves the company.