I mark each of my hardware wallets with typical “wear and tear” marks. I check for these each time before I use the device.
A substitution attack would be effective otherwise as the first thing you would do is enter your password allowing the attacker to transmit it to them and the original device.