I believe an untampered Ledger is still OK as long as you don't pair it with a compromised machine, which perhaps is not saying much at the present moment...

The security model of Ledger wallets should survive even a compromised computer/phone, assuming you have an out-of-band way to compare address destinations and hashes.