I think many users are confuse between hack and attack.

Phishing, malware, keylogger, spyware or anything that caused by the user fault, isn't hacking, but these are online attack.

While hack mean the user didn't do any fault, they have make sure they're not do anything wrong, but someone access their wallet. Since ledger send the encrypted private key to other partners, this mean if someone can break the encrypted file, they can access your wallet even you're didn't do anything wrong.

So in summary, ledger is hackable.