The risk of supply chain attacks makes hardware self-custody too dangerous for average investors