Even if you bought your Ledger off Amazon and it was filled by Amazon itself on behalf of the official Ledger store I'd still be throwing that thing in the trash. You gotta assume that the entire supply chain is compromised. Ledger as usual is completely silent about all of this.