Agreed.

Hopefully this kind of build ends up being a stepping stone to a more secure, more robust setup later on. A useful stage but not the end destination.

It's like self-custody with single sig; having it at all is way better than not doing any self-custody, but there are lots of not really solvable risks with single sig.

The hope is that they get comfortable and then level up to multisig when they're ready.