It'd be big, specially for Trezor as a company; but I don't think it would be that big or even profitable in terms of money if you think about it. Being offline devices, the damage would be considerably mitigated by time alone. You'd (hopefully) get an email from Trezor an hour after the first few cases confirm a trend warning you to not plug and power your hw anywhere.

Going through the long con of modifying a chip design, going into production, distributing to retailers/waiting for the chips to be used by a company, and then sold and used; only to then choose a date when enough are in circulation to trigger the 0day, and only get as bounty the first random few wallets that come online that day... There are probably easier less involved ways to be a criminal.

They could try to simply sneak out a couple packets with key data every so often, and just acumulate them for the future; but that would get easily found out by people using them in secure networks.