I always thought the Ledger criticism re the CSM breach was over the top. They can’t ship you a product if they don’t have your information and these databases are constantly compromised. I assume they picked a vendor with due diligence and still were burned. The key recovery fiasco maybe more concerning, but I don’t use it or LedgerLive so I’m personally unconcerned. My guess is both issues have NVK with a can full of gas and a handful of matches.