What is out of scope

The Out of scope section of the threat model is the authoritative list, and it is deliberately long. In particular, reports that amount to "there is no secure element" or "a physical attacker with the SD card can attempt an offline PIN attack" are known and documented design limits, not vulnerabilities.

If you think a documented limitation is understated or misleading, that is worth reporting. Overclaiming in the threat model is itself a security bug in a project whose value rests on being honest about its boundaries.