okay but *everyone* keeps a copy of the 3 xpubs, you and the lender, and it can be copied infinitely

and if it is leaked there is no risk except transaction privacy… so, basically misinfo