The passphrase only buys you time in a brute force attack dependent on the complexity and entropy used. Relying only on the passphrase is not enough. My opinion (like a belly button we all have one) is that for the money you can get better hardware. If you are not leaving the Trezor lying around the likelihood of the hardware vulnerability found being exploited is quite low but not non zero. It’s a good product that requires a hardware refresh to remain competitive.