Ledger is not the one who tampered the hardware that CryptoBilis is selling. And for the context of history, CryptoBilis has a new owner, as it was sold recently. And that's where the tampering happened when the new owner takes over. It is also said that the old owner should be held accountable, however, they don't have accessed to any of it as obviously they are hands off already.

As for buying, I do understand, with the Coldcard incident and now this one, we should really be very careful. We might go back to the old and traditional way of keeping our Bitcoin safes and no longer trust this 3rd party wallets.

You are currently communicating with someone who was a direct seller and participated in the sale of these wallets with or without a referral link (I don't know), but with bonuses that people were very interested in. Therefore, we could better learn about all the risks that buyers could expect from such sellers or agents, because everything that happens behind the scene is most often of interest to those who are in this environment.😉
https://bt.irlbtc.com/view/5049582.0

The key takeaway is that not taking action to remove supply chain risks does not remove the risk as an authorized reseller. But the direct purchase from the manufacturer cannot guarantee users against all types of attacks. The recovery phrase should only be provided by the owner and the wallet initialized on the hardware wallet. Never use a Recovery Phrase if it has been prewritten on the device. The actual security check isn't in the area you purchased the wallet. But if you have control on the entire setup process.

Yea, it is never adviceable buying wallets directly from third parties especially because of the risks of compromise. However, this case here is not about third parties. It is still about dealing with the manufacturer directly although through one of their suppliers.

Even though the supplier may not be considered a third party, it is still very risky for a wallet to pass through any other person before it reaches the buyer. The manufacturer of ledger wallet will have to take responsibility for this loss. I am believing that one of their actions towards recovering the amount lost is by investigating the supplier to confirm if they had a hand in this since lots of fingers are already pointing at them.

Report also has it that cryptobilis was recently bought. Ledger had the duty to discontinue any relationship with the new management of Cryptobilis until they are certain the new management of the supplier meet the criteria to do business with them. I guess that part was ignored. This is the reason why ledger will also take full responsibility for these compromise, so when choosing suppliers later in the future, they will screen them properly.

Even if your are buying from resellers or vendors it should be from a genuine and reliable source that can be held responsible if anything goes wrong at any point in time.

We have some trusted vendors and if you know that you are not satisfied with what you feel or seeing it is better you don't purchase from them but rather go straight to the manufacturer to buy by visiting the website or any means of contact after purchasing, confirm the seal if not already broken because for authenticity and originality you are to break the seal yourself, in that way you can be sure of what you bought and then generate your new offline recovery phrase by yourself and not any other one.
Getting directly remains the safest and trustworthy.

We can all agree that all of it has risk that they share with but some of it can have the minimal ones.

I agree on this but, there's also a risk with it when there are collaborated actions being done that includes the couriers and sorting areas. We'll never know how safe it is from there although it gives more confidence to do the purchase directly from the manufacturer.

I will concord that every company have their dealer who they approve to be marketing their products it's their duty to know them very well having information like this, the producer need hold them responsible for the breached of their products because they are the one entrusted selling to customers. But buying wallet from third party is dangerous naturally is like creating your bank account with road side personnel you know nothing about which can denial your transaction at any given time, the world and it's system is becoming more on high gambling that many will not know the direction to go either who to trust, as everything is having one or two risk that people will not like to take such adventure.

Coldcard incident is from the wallet source code, the firmware but not from authorized resellers (vendors).
Ledger incident is from one authorize reseller (vendor) but there are possible more vendors like CryptoBillis with Ledger wallet delivery, it's quite scary.

Coldcard and Ledger incidents are very different with each other.

The case of Ledger incident with CryptoBillis is scary enough to push people away from hardware wallets because from now many people feel like they can not trust any hardware wallet resellers - authorized ones.

It's easy to don't trust hardware wallet sellers that are not authorized by a hardware wallet manufacturer but if even authorized ones can scam, how will people safely buy hardware wallets?
If it is not safe with Ledger, will it be safe with other hardware wallets?

As far as this third party reseller is approved by Ledger we cannot blame the victims who were scammed with fake Ledger wallets because buying from an approved reseller of a product is as good as buying it from the main source. But it is very unfortunate that it turned out that fake products of Ledger were distributed through a supposedly trusted affiliate, I agree that Ledger should also take responsibility for this scam. We would wait for the conclusion of investigation to know the parties that are involved in this unfortunate event but I doubt that Ledger would jeopardize their reputation to be a part of it. Lesson to learn from this is that if you want to order for your hardware wallet you should priotize ordering directly from the source instead using third party affiliates.

To avoid all these kinds of things, because when you look at it, I feel like there are companies that you can do it directly, so there will be no need for a third party, because anything involving a third party will be a risk you have to be responsible for yourself, because I'm sure that there are links that, if anything should happen, they can be held responsible because anything that you are buying in this space, trust needs to be one of the up front because that is one way you can be safe because security matters and every form of third party should be avoided.