Sad to see so many people with seemingly zero background in hardware security comfortably passing expert judgement about this attack, apparently without either looking into the security model of the attacked platform (it's public and worth a read, in my view [1]) or into the sophistication of the attack itself.

Ledger's mistake here was solely assuming that fitting hardware capable of long-range (or even global, in this case) communication into the tiny footprint of their device's case was impossible. I'm not in their industry, but I'd honestly have guessed the same until this week.

[1] https://www.ledger.com/ledger-nano-x-bluetooth-security-mode...