When things like this happen it is hard to tell the difference between incopetence and malice. The RNG exploit in coldcard could as well have been placed there intentionaly.