Is a limitation here that, for example, the 3/5 MS must wait four months or less, but you have no idea 3/5 are compromised/colluding until they broadcast a spending transaction? Effectively after six months it’s just m of n anyway?

You have zero compromised visibility without rolling the crypto and moving the money monthly for example?

For me, this is one of the primary concerns with any private keys or secrets. There is no easy way to be notified at the time of compromise (aka. A broken seal). Only when first abused. I don’t know the solution.