Ledger says a MediaTek flaw may let attackers extract PINs, wallet recovery phrases and encrypted data from Android phones.