Incidentally, this is also a flaw with the default Casa multisig setup.
Discussion
I agree. I would say however since Casa is no KYC and not all tightly integrated under one company the effect is nowhere near as big of a problem. People just need to be sure to signup with a generic protonmail or other private email.