So, here's an interesting piece of data. The one that you show a screenshot of, as well as another one I may have seen, include the purchased device as a "Coldcard Calculator." that sounds to me like something that might be declared as a package contents or the like. This would make me think the fulfillment company could be the weak link here.

Noticed that also. That's what made me think customs was an option. I assumed the devices were shipped by Coinkite directly. The more digging we do, the more it looks like it's someone in the shipping chain. The customer end looks very secure still.

I recall seeing the word "calculator" on the commercial invoice when i purchased a @npub19can...qj29 previously. Very likely it is the party responsible for generating the commercial invoice or customs directly.