I’m personally done with these sucker devices. I knew that they tend to leak your address so I always used a PO box but the attack vector is way too high, be it software side, supply chain or manufacturing side.

Yeah it’s scary. Multisig seems like the safest storage option.