pro tip regarding this: it is possible to setup a passphrase that is "added" to the seed (you have to enter this on the wallet host). That way the passphrase has to be brute-forced, too (or key-logged beforehand). That passphrase is not stored on trezor. You can even use multiple different ones (resulting in different wallets) for plausible deniability.