It’s way more likely it was an insider at coldcard that knew about the vulnerability.