So one of the intended uses for a Decker is to protect the team's matrix butt while on a run. In theory, this is done by slaving devices to the Decker's Cyberdeck. Cyberdecks do not necessarily work in this capacity for a couple of reasons:
1) You can only slave Device Rating X 3 devices to a cyberdeck (or any other device) and Cyberdecks tend to have low device ratings. The 200k decks are only device rating 3, for example.
2) Cyberdecks have configurable attributes, and an active Decker may not be placing their highest ratting in Firewall while on a run, or engaging in cybercombat with a spider or enemy decker. By contrast, a rating 6 commlink will provide a consistent rating 6 firewall at all times.
Now it is important that the Decker be in charge of the matrix defense of the team if for no other reason than if an enemy decker or security spider attempts to Hack on the Fly vs someone in the team, and fails, the device owner gets a mark on the enemy decker or spider. The team mage or gun-bunny has very little use for that free mark, because without a sleaze or attack rating, and a lot of skill, they can't do anything with it. It's best on a run that it be the team hacker getting the "attack alerts" and free marks, as they are the most likely to do anything about it.
So here's my theory: Extra Commlinks. The team Decker should have enough Transys Avalon (rating 6 = 18 connections each) Commlinks that everyone in the party can slave their active wireless devices to it. These commlinks should be owned by the Decker, which means all the slaved devices are integrated into his PAN. Anyone attempting to hack the Gunbunny's dual machine pistols will be up against the Commlink's Firewall 6 + Decker's Willpower. If I'm understanding the hacking rules: if it was a Brute Force attack, and it succeeded, the Decker is alerted. If it was a Sleaze action, and it failed, the Decker now has a mark on the Persona that tried it. Essentially the Decker has Matrix Overwatch for the team.
The downside to this setup is that the commlink doesn't have a Sleaze attribute, so it's not very good at hiding silent icons, although it's clearly no worse than letting the rest of team deal with their own PANs. Devices slaved to a Cyberdeck get to use it's sleaze to avoid being located. The flip side, however, is that devices running silent are hard to conceal. It can be hard to locate a device, but knowing one is present within 100m is actually very easy, regardless of Sleeze ratings. Any secure facility or checkpoint will be looking for hidden icons with a signal scanner, and detecting any is likely to trigger suspicion if not actual alerts. Because of this, running silent may not always be the best option for devices. Instead, concealing the nature of the icons may be more effective, and that means the Wrapper program. Running the Wrapper program on your cyberdeck, and having the team's matrix assets slaved to your extra commlinks (and thus part of your PAN) should let you alter their icons to look like safe and legal basic belongings. It might actually be a good idea for a Decker to buy a "Scratch-Built Junk" RCC specifically to run the wrapper program, and thus free up a program slot on the cyberdeck for hacking software. The cheap RCC can be slaved to a commlink too, of course.