Look at Intel/AMD etc with Meltdown and Spectre and they are a huge company.
yup, i've been talking about the large attack surface and questionable authentication practices underlying hardware wallets for a while. the vulnerability seems to exploit the shared attestation (vs. authentication) problem that eric voskuil touches on
here.
the "supply chain" attack he outlines is pretty worrisome. better steer clear of 3rd party resellers on ebay, amazon, etc!