Trezor – Can a hacker use RECOVERY SEED to rebuild my wallet without my Trezor password?

I am aware that a hacker could use my recovery seedphrase to rebuild my wallet from another Trezor or compatible hot wallet. This will take me to the root of my original account. But what if I also have a password? I think they need to know that too to access the account.

Also, if I know the passphrase, do I need a physical Trezor to access my account?