[radicaldreamer]

Seems like this could also be an insider threat where someone at Trezor knew all the BOM details and could pull this off

[wmf]

Trezor is mostly open hardware and open source firmware to begin with.