Is this just as secure as a paper wallet? I should imagine it isn't because it requires you the manufacturer to actually have access to the private keys?
The keys are generated using entropy from the trezor plus entropy from the computer you plug into. There's no way for the manufacturer to know your keys.
Well, if the manufacturer of a hardware wanted to get the client's keys, they could do it very easily.
If you use a special-purpose hardware to store your keys, you have to trust the manufacturer. I see no way around it.