Maybe I am misunderstanding you but in your model, it appears that any derived key that can produce a higher index is implicitly authoritative, because there is no separate authorization step.

A compromised device doesn’t need the seed forever, it just needs it once to jump the counter and publish a “newest” npub. From the network’s point of view, that looks indistinguishable from intent.

Cold Root Identity separates those roles. Derivation is cheap and local. Authority is explicit and verifiable. Clients don’t infer intent from an index. They verify an authorization.