Typical cryptocurrency hardware wallet is horribly insecure as far as typical requirements for HSM go, which is at least to me somewhat expected and understandable.

The reason for that is that such devices are primarily designed to move the key materialoutside of the effectively allways online client device and thus the typical HSM-style threat models are outside of the design scope.

This is somewhat understandable because designing truly secure HSM is borderline impossible and certainly not economically meaningful for most of the target market.