I am a newbie, and I want be safer.
     I'm not confident in closed-source hardware wallets like Ledger. Open source hardware wallets can be found here. (

Open Source Hardware Wallets,

https://bitcointalk.org/index.php?topic=5288971.0)
     I chose trezor and bitbox，because of they have more customers and are more famous, and a lot of experienced experts will check their codes. Their firmware on official website are loaded and installed before first use. The trezor suite is also 100% open-source, and was verified.
     Prevention measures: (1) If I set a passphrase with at least 15 characters (0-9, a-z, A-Z), then Trezor or bitbox will never know it and cannot crack it? This can prevent hidden backdoors in the mnemonic seed, which is very difficult to verify. (2) If I wait a few months (>2 months) to update the firmware after it was released. Then this can against malicious firmware from Trezor or bitbox company. (see “How to prevent if The Trezor release new firmware update to steal Bitcoin”, https://bitcointalk.org/index.php?topic=5386771.0).
     Are there any other possible risks from the hardware wallet companies?