Amazon's inventory is not pristine. They routiney mix 3rd party sellers with their own manufacturer sourced stuff. Some reviewers are idiots because they think just because they bought the product from Amazon that it went through the proper channels and didn't pay attention the Buy Box when clicking add to cart. I have received counterfeit items from flash memory to batteries that was sold directly by Amazon. I can only assume the inventory was mixed by accident, but at this point I doubt Amazon cares as it's just riding on it's bulk.

While it's not guaranteed every 3rd party hardware wallet will contain malicious code, you can be certain there's definitely a motive to have somebody want to steal your passphrase. If there's a way, there's a will.