However, could this be an attack vector? AKA a government shuts down all the companies? Confiscates/corrupts all the software?
Manufacturers of hardware wallets assume that the device generates private keys in a secure way that is not connected and will not connected to the Internet. They also use a standard to generate seeds. These standards are not tied to a specific vendor, so you can import the private key using any other wallet, or even ask a programmer to write a wallet compatible with that standard.
If the hardware wallet uses their own standard or there is no way to know how to generate the private key, then there is no difference between them and closed source wallets, and therefore your money is at risk and it is better to avoid them.
This applies to some altcoins that do not have an active developing.
for those altcoins keeping in in HW or CEX is the same.