1. TREZOR: steal the device, then use the extraction method you refer to above to get the seed (and coins).
2. TREZOR: steal the device, then spend eternity trying to crack it (because it's passphrase-protected).
3. Paper Wallet: steal the wallet, then simply sweep the QR code to get the coins!
I'd go with a TREZOR...
paper wallets can have passphrases too. bip38
or bip39, cant remember. i used passphrase protected paper wallets for years till i swept them to sell off the bcash_lol crap.
now i have a trezor 1, trezor T and a ledger plus some paper wallets. spreading stuff out never hurts.
EDIT: Totscha already mentioned it (bip38) here
https://bitcointalk.org/index.php?topic=178336.msg48984707#msg48984707