Blockstream doesn't know I'm a client.
Trezor has BTC-Only firmware. (But I agree they should airgap)
Keystone has BTC-Only firmware too. In fact they have like 4 flavors of firmware to choose from.