What I don't understand is what it has to do with BitBox being a decent HW wallet or not. Are they (or Shift Crypto) keeping records of who's purchased them or something? Even if they are, that doesn't even sound like what the AOPP thing is all about. I'm still a bit confused (but that's a normal state for me anyhow).
If wallet developers decide to support what the government can use to effectively invade people's privacy, normally bitcoin community will not support that, they support what will help achieving privacy. If done in a country successfully, other countries may also make it a law, making their custizens to prove the ownership of external wallet addresses.
This (AOPP) has nothing to do with purchase of hardware wallet, if Shiftcrypto handle customers data appropriately and not sell it or give it out to third party, then the data are in safe hand), but we could not even conclude this as mentioned about because we do not know the next to Ledger data leak after
Trezor admitted users email address leak.