I think Bitcoin Red Team checked it, so basic AI model check is done.

One thing to point out though is there's a huge difference between Sparrow and Coldcard. Sparrow is an open source project (true open source - free to modify), a public good that people should audit and there's no pressure on @craigraw to pay bounties, etc.

ColdCard is a commercial company. They are selling a product and they are responsible for security. Their source code was made available, but people couldn't reuse it (license forbidden it). So essentially there was almost no incentive for people to audit it.

People who are not paying ColdCard money won't audit it because they can't use the code anyway, so they don't care.

People who are paying ColdCard money assume that a commercial product is well audited by third parties, because what they're selling is a security product.

ColdCard was selling a vaporware though, which is basically a scam. Nicely looking calculator with buzzwords instead of real security.