The question is should we follow the security tips from the Ledger company that allowed such a data leak? It seems to me they have no idea how to hide something sensitive and important. The leak of that data may result not only in a loss of funds but also in a loss of someone's lives, which is obviously more important than bitcoins stored on Ledger hardware wallets.
The leak doesn't have anything to do with additional security features their products have. If you're paranoid about their temporary PINs, then there are so many other things you should worry about as well - ending up not owning any hardware at all. They might've had shitty database protection, but their products have been long tested. Still unsure what their Secure Element does though - that is a big question mark for me as well, and it makes me kinda paranoid about its existence.
In my opinion, plausible deniability in such a case won't help since attackers are usually well aware of any tricks that one may come up with a Ledger hardware wallet. You don't think they'll leave you alone after taking your $100, do you? Personally, I doubt it.
Well, if that's the case then they may also not leave you alone even after giving the temporary password. Luck matters here too. If they're ready to take everything from you and leave you without life afterwards, then no matter what you do you'll still have to face death.
It is better to get rid of your Ledger altogether and try to persuade attackers you had sold all stupid bitcoins and stupid hardware wallets because it was dangerous to deal with those after a leak happened. Otherwise, once you show you still have it, you are most likely done.
Quite sure negotiation isn't an option when an attacker is inside your home. You either show it or you don't, they don't have time for stories.
And sure, there's a decent chance that the thief might know about the temporary PIN trick, but it's at least worth trying to pull it off.
Then one could set up multiple temporary PINs - one for cases such as hostage and torture, one for the actual portfolio you own. If someone ever attacks you, show them the main password. If they keep insisting to give away a temporary password as well, give them the one ready specifically for this purpose.
