"The Supply Chain Attacker"

This is a cunning physical attacker. They buy genuine hardware wallets, open them, record the Seed Phrase (password), and then re-wrap them in seemingly brand new and neat seal plastic. Then, they sell them on eBay or Amazon at a discounted price. The naive buyer thinks they are getting a new item, loads funds into it, and the attacker—who has held the keys from the beginning—remotely drains the funds.