Isn't the actual mistake here to _at all_ fall back to some other RNG, which (at least in this case) is known to rely on less entropy than the main RNG? I mean .. shouldn't the hardware wallet instead just print a message like "RNG failed .. no seed generation possible .. please update firmware."?