"There need to be more physical locations where one can buy hardware wallets for cash!"
YES!!!!!
Obviously, supply chain attacks are a thing. But, that risk can't be completely eliminated either way... making any potential additional risks introduced by purchasing online seem unnecessary if at all avoidable.
It would probably be better for wallet manufactures to facilitate a culture of customers verifying the authenticity of their devices AFTER the customer has taken possession rather than the security theater of an unachievable protection from supply chain attacks.
