Wow, best explanation so far. Makes sense to me. I'm disappointed in the way the Nano dev team is dealing with this situation.
Many people got suspicious when Francesco suspended withdrawals without prior notice for so called KYC regulatory reasons, and some accused him of effectively violating his own ToS. So when he then announced the hack, I can understand why people thought he was trying to do an exit scam. His way of communicating and quarrelling on Twitter with frustrated account holders did not help either.
For me it would somehow be more bearable if I lost my Nano to an external hacker than if I lost my nano to Francesco. But then, I can perfectly understand if someone who just lost most of his life savings disagrees with me on this.