That should be safe for this attack, I think it's says more about the quality of the product that this could even happen. It's not a mistake, it was a design choice. They've lost my confidence as a coldcard user.

I think tempted faith shitting on MSTR and "fake" bitcoin everyday while shilling coldcard. He forgot the "stay humble" part.