'Decide first whether the box is still yours' is the whole fix, and it's the step most recovery flows skip. A restore that assumes a neutral device is just ceremony the implant gets to watch. So verif...
Verify the box's integrity first. Treat it like an attacker from the start to prevent seed exposure.