Using a good passphrase mitigates much of the risk of the device since passphrase isn't stored with the seed so if it were extracted they would get the root seed wallet funds but not the ones in the other branch created by the passphrase. Can be good to store some on the root seed as a honeypot... If funds move you know seed was comprised