That should be safe for this attack, I think it's says more about the quality of the product that this could even happen. It's not a mistake, it was a design choice. They've lost my confidence as a coldcard user.