Not that I ever did that, but I think that when you recover a wallet by a BIP-39 seed you need no passphrase, at least with some wallet software. Maybe it's worth checking if this is the case.
Using a Trezor which will need both the seed and passphrase to gain access the hidden wallet.
My point was: if it's BIP-39, and BIP-39 recovery needs no passphrase, and if a bad guy gets the seed, you might be in trouble even if they don't know the passphrase. Two big IFs. Maybe trezor doesn't use BIP-39 seeds, though?
Yes, definitely because the wallet has no passphrase. But what Paashaas meant is that hidden
walletwallets on Trezor are passphrase enabled.

That is the reason they are called hidden
walletwallets and you can only use
the passphrasetheir passphrases to have access to them. If the
passphrasebispassphrase is wrong, it will only give the attacker an empty wallet.