I've been reading that 2/3 multisig setups that had weak key generation are at risk as well. My understanding was that even if you knew 2 private keys, you wouldn't be able to sign a transaction because you don't know enough information about the 3rd private key to reconstruct the wallet configuration (that json file created when you set up a multisig).

Is my understanding incorrect