All these attacks/failures were known point of failures, and will probably always be. The Ledger implant isn't a surprise, it's the same as having anyone access your computer or phone, when you aren't around. Implants are real issues, often hard to detect (sometimes invisible, in a similar looking chip or at software/firmware level). An implant during the supply chain is a known risk in the threat model. An implant while you aren't at home, left your computer behind at the hotel, etc, are targeted but also possible. The Coldcard bug was harder to deal with. It should NOT have been undetected for so long, it shows how even in open source, most people rely on others and don't take the steps to check an external audit was funded and delivered. Still, having all these coming at the same time act as a very good immune system booster, everyone is improving their setup, processes, and most importantly knowledge. We'll lose a few people to custodians and paper bitcoin, but freedom isn't free.