A password for key derivation prevents this attack and all other physical attacks. Trezor has supported this since day one.