There is always a risk, it does not necessarily mean that the shipment will come infected from the EU, it can be infected by anyone in the delivery chain so it is best to to pick it up in gloves, throw away the envelope and disinfect the Ledger packaging.
I assume the delivery time would be about 7 days under normal circumstances, but due to the current situation it is likely more than that. There is an alternative to ordering the device from authorized resellers in the USA, which certainly shortens the delivery time.