Official shop is always the best place to purchase stuff like this.
That is that is because your not thinking like a paranoid tinfoil hat person. Also keep in mind that compromising device like this would not just be about compromising a hardware Bitcoin wallet, it would be about compromising thousands of IoT things that could be anywhere doing anything giving who knows whom access to who knows what.
Getting some Bitcoin out of the deal would just be a bonus, but how many people would buy some like the field tech I know, and then hook these devices up to whatever and have no clue that they're not original hardware. They look like it, they act like it, but they're not. So who the heck knows what is embedded deep down inside. Could be nothing and these were just cheap knockoffs that they were selling , or they could have some vicious code buried somewhere. Personally I'm going with the benign theory and people are just out to make a buck.
But why risk it, which is why I and then you pointed out that anybody getting these should only be buying them from m5stack.com or their approved suppliers.
-Dave