💯 multisig and true self made entropy is the best line of defence. Your own entropy would have protected against the Coldcard bug, and multisig against the Ledger and Trezor implants. But vendors have a duty too. Tamper evident builds and devices you can verify yourself, so supply chain attacks get caught before they cost anyone.