can they somehow link which trezor wallet i use from payment or order info
As far as I know, all they can infer is that the owner of the credit/debit card or PayPal account (you) has bought a Trezor device. If you’re worried, you could buy a new one from an authorized reseller, or buy from Trezor again but with a new account and pay by cryptocurrency.
if they have any backdoors
No backdoor was found till this day (some vulnerabilities are found, but they are all physical hack and can be mitigated, they are not intentional backdoors). Trezor is one of the most reputable hardware wallet brands. Everything is open source: the hardware device itself, the firmware, the client. You can literally build the entire Trezor devices yourself. The files for the 3d printable case is on Trezor’s github, along with the schematics for the circuit boards and all of the little electrical parts needed to make your own.
It depends on your threat model, but you might want to check out how to run your own node for your privacy, and how to recover your Monero wallet on other devices (Trezor’s Monero seed phrase is different from other standard Monero wallets)