Yes they could take the money if they knew the pin. They could either send it to another wallet or they could prompt the cold card to show them your seed phrase. Using a pass phrase actually creates a second wallet, which is your seed phrase plus the pass phrase. So when they got into your coldcard, they would see what is in the non-passphrase wallet but there is nothing to alert them to the fact that you also have a passphrase wallet. That’s why it can be a good idea to keep a minority of your funds in the wallet with no passphrase as a decoy, so they think they got all your money. I didn’t realize until recently that adding a passphrase actually gives you a second private key that is completely different than the original seed phrase. The coldcard doesn’t indicate that there is any passphrase associated with it, so there is nothing to give someone a clue that you have one. Just remember that adding a passphrase does not protect whatever funds are in your current wallet. You have to send them to the new address protected by the passphrase.