TL;DR on the Coldcard vulnerability: If you didn't provide the entropy for your seed (didn't roll a dice 100+ times and/or add a solid '25th-word' passphrase) you need to be moving your funds ASAP. The MK3 is most vulnerable, but the MK4 and Q are also affected.