Do both trezor and ledger have the potential to access your private key?

Now, we all know that there are Multiple coldwallets all with various firmware and applications. Recently ledger got some flak for admitting that they've always had the potential to access your private key through updates. People quickly turned to trezor which seemingly was different in regards to this and wouldn't be able to access your private key (based on what)?

Now an insider at trezor says they have the same potential as ledger to access your key: https://crypto.news/trezor-developer-confirms-private-keys-can-be-extracted-if-firmware-is-corrupt.

Have I misunderstood something here or have this just gone under the radar?