Ledger is hardware wallet which assumed to be secured from remote hackings or hackings by malwares, but how about Ledger company itself? How difficult for the company to get access to our confidential information in the ledger wallets? Is it secured from this kind of risk by design?
If you want to assume the worst, remember the adage that if an attacker owns has physical access to your hardware then they can pwn your hardware.
The vendor effectively had access to your hardware so theoretically could have backdoor code into it.
However... What is the likelihood that they have access and would use it? It would ruin their reputation and future business if they did this. They might do that - similar things have happened in the past, but we cannot predict whether or not that company would act like that.