If I had funds at risk, I would move KYC funds to a custodian like River or Strike (Coinbase if that’s the only option) until I could get a new hardware wallet I trust, and move back to self-custody.

I like Trezor because they have been building hardware wallets longer than anyone and Ledger security labs is constantly trying to find vulnerabilities in Trezor. I would struggle to name another vendor I trust at the moment. Definitely not Ledger because they have a recovery service that extracts the seed from your device - proving the seed could be extracted via a hack).

For non-KYC, if it was me, I’d temporarily move it to a sparrow wallet on a laptop or a hot wallet like Phoenix on a phone then keep the laptop/phone powered off and stored securely until I had the new hardware wallet to move to.

If you’re moving large amounts of funds - please do it carefully and send small test transactions first so you don’t make any mistakes, ensure you have adequate backups and test your recovery process before moving funds to ensure you backed everything up correctly. If you’re moving to multisig make sure you backup everything needed to recover (e.g. in addition to BIP-39 seed phrase you will need wallet descriptor/XPUB backed up - I’m not an expert on multisig, so do your own research).