I thought it (coldcard) was at one point then a lot of the code was used for the passport and so they locked it down. Totally get that means it was never open source.
I’ve built a couple of seedsigners and setup a kruz and enjoyed them.
Basically, I’d never use a single vendor, multisig and multivendor only.