This story is a case of someone tampering with devices in the supply chain, before the user first receives them.

What you’re describing is a different thing. It’s an “evil maid” attack, when you tamper with a wallet that is already set up by the user. Also, it would be ultra difficult and expensive.

What you’re saying is possible. But:

It would probably be cheaper to build a total fake Ledger Wallet, then just replace the new real wallet and deliver a fake with a weak entropy generator. Any case, that’s not what has happened this time.