When was the last time a large vendor had an HSM compromised directly? Malicious code signed, sure, but I've never heard of keys being leaked from an internal H

When was the last time a large vendor had an HSM compromised directly? Malicious code signed, sure, but I've never heard of keys being leaked from an internal HSM that the attackers didn't have high levels of access to. It seems to me the threat model for consumers is the same either way. The box itself doesn't offer any meaningful tamper-evidence, so a sophisticated attacker would just re-shrinkwrap everything if they couldn't update them this way.