Food for thought:
What if this attack isn’t over? What if it goes on for months?
How many devices were sold and how likely is it that the majority of users even know?
Right now there is no metric...
If coinkite really cared at all, they would use their manufacturing serial number information and their source code and grab all the bitcoin on behalf of its customers, then publish the utxos they recovered and distribute them back after proof is provided the customer owns the device from which it originated.
1