Trezor or Ledger, which one do you recommend? Both of them has been targeted with cyberattacks/phishing and malware recently.

Isn't it that this method would just do more harm than good as there is a greater possibility that they are selling tampered or compromised hardware wallet products? Although I am aware that they have a list of authorized resellers.

As far as I know, the safest way to purchase a hardware wallet is by going thru their official website and provide a false information to fill your real name, home address, email, phone number and what not upon purchasing. You can even provide a PO/ PO Box (Post Office) as the drop-off location for your parcel -- it would not be a problem tracking your package since Leger provides a tracking number upon purchase.

Moreover, as a customer, you also have the right to request in removing all the personal information you have provided in their website. Unfortunately, it's too late for me to able to request a deletion appeal on their website since their database has now been compromised