This is a disaster waiting to happen. Those in what I call "the cult" not only collect xpubs but also send derived private keys to untrusted servers also maintained by them. That will be the Coldcard ...
Indeed ... at least, i agree that xpubs were a mistake of category: they should be treated as private key material. They should have been called 'x-still-priv-actually' 😁
❤️3