I get that is great UX.
But if we really get paranoid the only silver bullet is to generate the seed out of the device 11 or 23 words and then the device will only generate the last word.
If the device is collecting entropy from the user, a software bug could always drop that entropy. So if you really do not want to trust the device at all, generating the seed outside of the device and letting the device generate the last word is the way.
Of couse it depends how paranoid once want to get.
And I am thinking about how that silver bullet approach could be done in a UX that will make it nice and.