Great question. You are vulnerable only if Coldcards in your set up make up a full N in an N-of-M quorem.
If you need to move:
Any multisig addresses that you have already used, just send it directly to the mempool. If the address has never been used, use Slipstream for those inputs.
https://slipstream.mara.com/
