They sniffed the LCD interface and OCR'ed the seed words when they were displayed using an implanted tiny CPU. This is a very sophisticated attack.
And besides, Ledger firmware can be updated to change fonts and such so it'd be long-term safer to just stream the raw data.