Yes, a profile can announce the xpub is using for derivation and provide derivation path for the subkeys used, but there are some security concerns about hardened derivation path if one subkey gets leaked, then with that SK and the xpub you can get the root SK if I'm not wrong (its fairly possible I'm wrong 😅)