The way I see it is simple
First -
i.e. Get the device before the twenty-seven-B-stroke-six forms are filled out and your device will be bureaucracy-free.
Also and related -
The more work “they” have to do to compromise a supply chain or the harder an interdiction is - the less likely “they” are going to blow their cover for little ole me.
My point is - check your own threat and risk profile.
Also generate a whole bunch of canary tokens to trip the bastids up. Including fake crypto wallets - or ones with just some dust.
here is a good start: