I look it at closer to the fact that a single trusted user doing it as a side hustle that only deals with hardware wallets is more likely to get away with the 'I don't keep records' thing if something happens then a full service company.
Yeah, that's a fair point. I guess you would then need to weigh up the pros and cons of not having your details shared with a hardware wallet manufacturer and all their third party buddies on one hand, versus inserting a third party in to the delivery chain and the theoretical risk of supply chain attacks. And even if you trust the third party not to attack your hardware wallet, do you also trust them to be as honest as they claim with your personal details and have a rock solid security set up?
But I guess if you are like me, and are getting to that level of paranoia, then the best option is probably going to be to ignore hardware wallets altogether and use an airgapped computer instead.
I look at it more as OP-Sec then paranoia. Going with the assumption (yeah I know assumption) that a trusted user here is a low risk source for supply chain attacks then it is IMO somewhat easy to be invisible.
Disposable email -> new account -> contact shipper-> give info -> send
BTC -> wait for delivery.
It could be you contacting the shipper, it could be theymos, it could be anyone, does not matter they would just need a name and address to ship to.
Taking about edge cases here, but still interesting to throw ideas around.
-Dave