BitBox has something called Anti-Klepto that makes this attack impossible. You can read more about it here: https://bitbox.swiss/blog/anti-klepto-explained-protection-against-leaking-private-keys/