There's a chance to get the keys out of Trezor (or any other hardware wallet) - you need very expensive equipment, knowledge and an access to the device. That's why a passphrase is a really good idea.

https://blog.kraken.com/post/3662/kraken-identifies-critical-flaw-in-trezor-hardware-wallets/