Since the passphrase is a part of the seed phrase it is still not safe if you just save and store it on an SD card that you usually use to connect to an online device. For complete protection and to make sure your wallet is safe better put your passphrase to any offline device you want or write it down on a piece of paper. If you keep your passphrase into that SD card that you usually use for signing and connecting to Sparrow you already break one of the rules to protect your wallet from online attacks.
I think offline attack is more possible with this because coldcard seed phrase will be kind of impossible to be known by online attackers. If QR code is used, it is perfectly airgapped in a way nothing can reveal the seed phrase to any online attacker. I do not know much about the SD card but Coldcard kind of recommending it.
Your COLDCARD doesn't store passphrases, therefore backup files don't contain passphrases. Backups capture the original seed, not the extended private key created by the passphrase. Passphrases can be stored on a microSD card whenever they are applied.
But I prefer just QR code for making transactions and also my passphrase to be stored on offline in a way I will have to type it manually.
