Sorry, but I'm quite confused as I never owned a Ledger. Isn't it a hardware wallet? Doesn't that mean it cannot connect to any network except the computer that you'll plug it into? Doesn't that mean that the only manner to expose your private keys is by establishing a connection with their servers once you plug it into your PC and by sending your private keys to their server?
Does it require downloading closed-source Ledger software as well for it to work? Sounds pretty fucked up situation.
Nah you are right. Its a hardware wallet which integrates with their software Ledger Live. All firmware updates are handled over Ledger Live. And since its closed-source no one knew that there is or was a
"backdoor" to extract the mnemonic phrase of your device.
Yesterday they launched their service called Ledger Recovery which caused the drama. The thread about it was already mentioned here but I recommend reading it:
https://bitcointalk.org/index.php?topic=5452900.0