They have a modular approach where the OS is not updated very often, and over it are running userland applets that define their own UI and features and can be a

They have a modular approach where the OS is not updated very often, and over it are running userland applets that define their own UI and features and can be audited separately. These applets are built using Ledger's SDK which make use of the security features of the OS through a bunch of scrutinized syscalls.