In this case it was a Ledger, repackaged with fake manuals and a scratch card for the compromised seed phrase.

Not sure what you mean with "lack recovery mode"? Or do you mean devices that can only generate a new key, and not import a seed?