A login security flaw at email provider Brevo allowed attackers to target 347,000 Trezor subscribers with phishing emails, highlighting risks in third-party vendor security.