Are you saying that 2 of 2 multisig is somehow just as, or even more, vulnerable than a single sig without passphrase? Because you need both, the prior seems safer than the latter. Glad to learn. Please explain your reasoning.