The hardware wallet maker said a fake security alert claimed a hardware flaw could expose users’ recovery phrases.