Ah, I take the first part back. There is a patch for the mk3 now. I saw a screenshot earlier that there wasn't.
Still, the problem remains an enormous problem, and people's trust in Coinkite products should be at zero, patched or no.
https://coldcard.com/docs/upgrade/