This is true with just about any HWW that allows you to add a BIP39 passphrase, but the challenge is that people tend to interpret the device’s access control mechanisms as infallible b/c they’re marketed that way, and then not use a passphrase. It’s a nuance of the traditional HWW security model that is a big problem.