So for this to be exploited, all someone needs to know is that your address was generated on one of these vulnerable Coldcards? No physical access is needed, they just cycle through likely seed phrases and bam, they now have wallet control?