Nice reminder of why friends don't let friends use #Trezor : https://btcguide.github.io/known-issues/hardware/trezor

Using hardware that leaks your xpub is like using hardware that puts a camera in your bedroom that a third party has access too. Just don't (unless you're into that sort of thing).