Do not scan QR code you find online, only scan when paying to another crypto wallet or you want to sell your BTC on an exchange, QR codes can come with malicious things too.
As for the software update from the companies, pray that nothing bad comes up from their side, I still strongly believe that they are the only thing that can easily messed up hardware wallet security.
Any time possible to phishing or malicious attacks on any wallet on your using device, I see many people face the problem.
1. download the app.
2. create the wallet.
3. save your wallet address.
4. save private key/seed.
(on your dairy or print it.)5. possible to convert QR on key/seed.
(then print)6. When you run out of needs. Then uninstall the wallet app.
*In this case, even if your device is damaged/phishing/malicious attacks, your money will remain intact.
These are my personal opinions, I have read some such blogs and watched some videos, which now I can't remember properly.