What are the possible failures of this multi-sig setup?

Setup:

1. Sparrow as the wallet organizer (unsure of technical term)
2. ColdCard as signer 1 (using updated firmware and software generated seed)
3. BitBox signing device as signer 2 with software generated seed
4. Both keys use a 13th word (passphrase)
5. Descriptor string stored securely separate from keys
6. Backup seed phrases stored securely separately
7. Both devices require a password (separete from passphrase) to unlock

What I am mostly conerned with is if 1 device gets comprimised in the same way the bugged ColdCards did, I would still be able to spend from the multi-sig wallet correct?

Even if BOTH devices were compromized but my passphrase was unknown to the atacker, i would STILL be able to spend from the multi-sig correct?

This feels like a pretty solid set up, I have gotten here since barely avoiding the Coldcard attack recently. I still think the Colcard device is a good device so I don't really want to get rid of it, but adding an additional device to the mix seems like a good solution.

Thoughts?