Agreed that multisig introduces complexity. It’s important to understand what the tradeoffs are.

The point of using a signing device (hardware wallet) is to protect one’s private keys from leaks during signing. In a single-sig setup, a malicious vendor or vendor vulnerability that causes keys to leak means loss of funds.

Multi-vendor multisig mitigates the vendor problem because it’s significantly less likely that two independent vendors will experience key-leakage issues at the same time. This increases complexity by a size-able amount, per your original post. To reconstruct the wallet, one needs the metadata.

The simplest vendor mitigation would be a M-of-N (M>1, N>1) multisig where all signers are kept together. In that case, it’s not urgent to store the metadata. The seed material is already all in the same place, so recovery can begin with seeds.

But this does not mitigate other risks such as discovery risk. If someone stumbles upon the cache of signers, the discoverer gets the coin. This is where geographically distributing comes in. Geographically distributed, multi-vendor multisig mitigates accidental discovery risk. It also introduces a time component, as even a dedicated attacker must travel between locations. But it increases complexity since now the metadata does need to be explicitly backed up, and the locations of signers is now a new secret to be kept.