2) Then I started to read about ledger's new update that implements a recovery feature that allows you the option to have them extract your recovery phrase to be stored with them. I think this totally asinine and contradicts getting a cold storage wallet in the first place. But I dont remember agreeing to it or not and this worries me. I also read that even if you do not agree to it, the update still gives them the "ability" to extract your recovery phrase. So how do I know if I agreed to it or not?
If you choose the paranoid route, it will be a hard one for you. So be ready for it.
They did already have access to the Secure Element. Ledger is not Open Source so the problem starts right there and then. You can do research, ask questions, wonder, do philosophy even. The truth is that Ledger may have had access to the backdoors of your Hardware Wallet at any given time until now. What you are doing is reading what the new update tells you. But nobody would tell you if they already had this ability to extract your recovery phrase because that would be illegal and it would also destroy every bit of the last standing points of their reputation.
Legally speaking, probably nothing will happen. But backdoors always existed. It was only 'safe' because Ledger will most likely not come to your house to steal your Hardware Wallet and access your seed. But who knows what information their Live app collected and where it went?
Open Source for the WIN. No thing beats Open Source.