I can not see into the device nor into app code (even if app has open source?), it may be unlikely, but maybe malicious official HW wallet application can be instructed to transmit private key or a seed phrase from the wallet to the manufacturer/third party? Is there any article on this topic?