Luckily, hacking still requires physical access to the device, and I'm sure this attack vector is even quite harmless compared to those users who voluntarily hand over their seed on phishing sites that pretend to be Trezor sites. However, for all those who use this HW, put a strong enough passphrase and hide it in a safe place separate from the seed.