python-mnemonic VS trezor-firmware

Yes. BIP39 defines a check word to ensure the previous words are correct. You can read the spec here: https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki

ColdCard follows the BIP-39 standard for encoding the wallet's seed as a series of 24 words (a.k.a. "seed menmonic", sometimes called a recovery phrase). If you followed the instructions you were given when initializing it and you've stored your seed mnemonic safely in the real world (not digitally where it can be more easily discovered), you're fine. In the event you lose or damage your ColdCard, you can initialize a new wallet--ANY wallet that follows the BIP-39 standard, which is pretty universal these days--and the wallet will regenerate the same private keysthat your original ColdCard did, in the same order.

... and BIP-39

Look-up "BIP32", "BIP39" and "BIP44", those will point you to documents describing precisely how seed phrases are converted into crypto keys.

i think bip39 is what you want to look up.

Not correct See this: https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki

https://trezor.io/ - Easy to use, no matter how new in Bitcoin you're.

Added (November 2021): https://github.com/trezor/trezor-firmware/pull/1903

Next thing to have is a hard wallet if you haven’t already like a Ledger or a Trezor and let it sit there. That’s the safest thing to do! Also, there’s always been a risk of KYC (Know Your Customer) on CEXes as mentioned several times. This was all meant to be decentralized and keep our identity under wraps and retain that anonymity that crypto was originally designed for… and you get a hold of your keys.

https://trezor.io/ - Easy to use, no matter how new in Bitcoin you're.

where "x.y.z" is the VERSION of trezor (aka TrezorCTL) you are trying to install. See the version history when picking a version. "Oldest" is not necessarily "best". You'll want to pick a version that was released around the same time your Trezor-1 was last updated.

I've purchased a Trezor model T from what I believe is the official Trezor website (https://trezor.io/). Is it rational for me to have a slight fear that it isn't a legit trezor and maybe the chip is compromised, possibly being able to send off my seed to an unknown party?