Ledger is closed source so their claim that their chip is secure is what they said but what cannot be audited publicly.
Ledger is aware of anti-klepto - but apparently won't bother due to shitcoinery
exhibit a:
https://www.ledger.com/blog/towards-a-trustless-bitcoin-wallet-with-miniscript (scroll down to leaking information)
exhibit b:
Discussion
That much is true, but does not hinder an anti-klepto implementation regardless.
Their excuse is shitcoins and being lazy to build the tooling around it