There will always be theoretical vulnerabilities. One vulnerability in practice is when fake ones are sold to unsuspecting buyers giving the makers of the fake hardware wallet access to the user's private keys. In practice, it's very difficult to have your coins stolen with such a wallet.