Self Custody Questions

As I’m getting into learning how to secure bitcoin with a cold wallet, it doesn’t seem obvious to me what the absolute best practice is for minimizing points of failure. When handling keys, I see two fundamental points of failure, that while similar, have distinct implications:

1. Losing your keys
2. Having your keys stolen

Given enough time, the probability of either happening will converge to 100%. I have no idea when this exceeds 50%, but let’s say a good guess for both is 10 years.

How does one combat this? For losing keys, one could make redundant copies in various locations, which increases security risk. Increasing security has basically unlimited possibilities, but surely they have tradeoffs.

It seems to me that the only way to ensure low probability of having bitcoin lost or stolen is to use a multisig wallet where the keys have a disjoint probability distribution of being lost or stolen (i.e. separate locations or separate people, though these are likely not completely disjoint). Then use a form of key rotation to ensure that at any given time there is a very minimal possibility of a majority of keys being lost or stolen.

All that said, I have a few questions.

Is it good practice to have some of these keys be hot/warm, such that they can be confirmed not lost? Or is it better to rely on the probability that most will not be lost during certain time-spans?

Is multisig key rotation already best practice?

Additionally, if any key from a multisig wallet is stolen, does that provide all of the addresses that belong to the multisig wallet? The reason I ask is because it seems like it would be a good security practice to have honey pots that when stolen alert that individual keys have in fact been stolen. But this practice is not reliable if an attacker can see that taking a honey pot would ruin their ability take a multisig wallet that is 1000x as large.

I hope this was clear. I appreciate any answers and opinions on the matter.

Edit: One more question. Can individual keys in a multisig wallet be rotated? I haven’t thought through all of the security implications, but it seems arduous and risky to warm up several cold keys just to do key rotation.