It turns out that belief in the vulnerability of ledgeris similar to belief in ghosts and UFOs - no one has seen them, can't prove their existence, but convinced that they definitely exist.

UFO are literally Unidentified Flying Object, so obviously someone saw them, but not identified.
I can also show real security vulnerability for previous version of ledger devices, and I can argue that ledger recover is another intentional ''vulnerability''.
I don't think you can setup a Ledger hardware wallet without their software: you need to "install" each coin on the device. But even if we ignore this, avoiding Ledger's software isn't enough if there's a possibility of malware to target the device.
One guy tried to do it, and he even release source code on github, but I dodn't follow how far he went with that project.
I think that the encryption part take place inside hardware wallet.
Really?

It's not happening inside toaster obviously...