Huh? Your guide can't protect customers from the USB REPL flag. That allows attackers who have physical access to an unlocked Coldcard to extract secrets, regardless of how they setup the wallet (using micriSD and diceware).
nevent1qqsqqqqlndpdfk2vfd48h7cyjcu29z0c9lr2vs883p93hqzjygd5mqczypj2eaq9t75...