The user is meant to keep a backup copy of the seed written down somewhere safe.

If the firmware had been tampered with, there is no safe way to extract the key. Better that the user uses the recovery seed on a fresh device.

Which means the weakest link of your fancy hardware wallet is how well you hide that bit of paper with your seed phrase.