When you get a trezor, it's been in someone else's hands, therefore it should be considered compromised. Again, you need to wipe it, not ever use the initial set of seed phrases it comes up with, and generate a new fresh set.
AFAIK, Trezors from the factory come uninitialised and require you to go through the full setup process on first use (my Trezor "One" did)If it has already been initialised and there is a note to text a number to get your seed mnemonic (or includes a pre-printed card with the seed mnemonic already on it)... then someone has most likely been "tampering" with it.
I'm questioning whether that first process truly is secure. Assume there is a Bad Guy at the factory checking units before sealing them in those nice little boxes. He simply notes the seed phrases in a unit, then seals it and ships it out.
Is the initialization process upon receipt of a unit such that this is impossible?
Let's not approach this from the point of view of "what does Trezor say you should do." Let's consider it a blank sheet of paper and start with first principles of security and see where that leads.
