You don’t necessarily have to lose the HW, the device can be stolen or hacked and put back in its original place so the owner finds out it was hacked only when connect it to the UI. It should also be noted that passphrase does not represent absolute security, it is also important that it is not too simple and subject to brute force hacking.
It makes more sense to me than that the device allows it to be done as many as 16 times (in case of Trezor). In case you have to reset the device for some reason, it makes more sense to do it with three wrong PINs, than with as many as 16, between which the time is doubled for each subsequent attempt. It is almost impossible for me to enter the wrong PIN 3 times in a row, unless I want to do just that.
Lucius,
If you employ all of Trezor T's capabilities its about as safe as it can get. Been studying and using trezorctl "deep" for the past few days. I have a spare and I am blowing away/resetting/etc.... and I find trezorctl very powerful in the right hands. There is NO realistic hack of SEED with use of the latest SD card protection, assuming you handle the SD card properly. Of course the additional password added to the SEED is further strength. I selected 24 words using trezorctl and then added 35 characters of BIP password for storage accounts! Overkill, yep!
I especially like the new PIN wipe/delete feature I enabled using trezorctl. If I want to intentionally wipe my trezor I simply enter one simple PIN and boom its cleared out! Don't know what I would do if presented with the $5 wrench attack, since I now have the option to present them/him/her with a PIN wipe code instead of my long real PIN. I do have an in between option with several hidden wallets, but that may now work out for me either. My SEED is in my bank deposit box. Could get ugly if I did give the wipe PIN, hmmmm?
For those reading along: know that the wipe PIN feature works great on Trezor 1's too. I have it on a handful of them just in case - you never know.