You are right of course. I know Trust Wallet had this massive bug https://www.ledger.com/blog/funds-of-every-wallet-created-with-the-trust-wallet-browser-extension-could-have-been-stolen
But has something similar ever occurred with a hardware wallet?