I remember when I created a long passphrase with my hardware wallet, complete with small and big letter, numbers, special characters, space. My goodness, it indeed felt excessive!

I felt like my Trezor would fall apart. Imagine pushing those small fragile buttons countless of times just to finish half of it only to reenter them all over again because you're provided with a wallet with zero balance, and it's next to impossible to get it right after only a single attempt despite double-checking it.

But, yeah, I got your point. I was just reminded of the big difference between the ideal and the practical.

You mean you actually saw the wallet get drained right in front of him just after he generated it on the ColdCard? There's possibility the device was tempered with or probably a fake device or maybe the seed was already compromised? Perhaps, he was testing on already compromised old seeds but applying different passphrase. Of course, if your seeds were generated with a weak entropy, adding a passphrase doesn't change much and might be just useless.

On the swept wallets question, one thing worth separating out: the passphrase is not a password that gets checked anywhere. In BIP39 the seed comes out of PBKDF2 with the mnemonic as the password and the string "mnemonic" plus your passphrase as the salt, so there is nothing stored to compare your input against. The BIP says it outright, that every passphrase generates a valid seed and only the correct one makes the wallet you wanted available. A typo does not throw an error, it opens a different wallet that happens to be empty.

That is also why a strong passphrase does not really answer the sweep. It covers one case, the one where someone has your seed words and not the phrase. If the entropy was bad when the seed was generated then nobody is guessing anything, the same keys get derived and the passphrase never comes into it. And 2048 iterations is not much work per candidate if it does come down to guessing, so a memorable phrase buys less than its length suggests.

Coins moving seconds after a deposit reads more like that than like a search. If someone had to brute force their way in, the timing would not be that tight.

I think that you are mixing up a bit the concepts with small distinctions. When you talk about the word verify and process of verifying firmware, that is not the same as being able to understand or audit some big code online. When you talk about verification you are talking about making sure that the firmware on the device matches what you have downloaded or the original code. Knowing how to verify firmware or downloads would not prevent the MK3 exploit. The case of MK3 is clear, firmware verification would not prevent anything because the exploit comes from an error in the software implementation because an error made it use the wrong RNG implementation.

Teaching people to verify firmware is not that hard, we sometimes teach people to verify wallet software downloads with hashes and that. To learn that you don't need to be any kind of tech bro, it can be part of basic computer use. But to be able to read code and understand it is very hard, and to be able to find security bugs in code is even harder. So the issue that we had here is that there was a big code error that was overlooked by everyone for a long time, knowing how to verify firmware would not have prevented that.

Did you miss or confuse anything?

Truly open source wallets are wallets that have open source code so that other developers can verify the code and reproduce wallets from source code.
What you said is source availability but can not be reproduced, and wallets like that are not considered as open source, just source available.

You can search about Reproducible open-source wallets, and Source-Viewable wallets.
With Reproducible open-source wallets, people can reproduce wallets from open source code, and create exactly similar wallets bit-by-bit like official wallets.

As far as I remember, I read that someone reported that their seed was hacked despite having a two-word passphrase on coldcard, but also that it was just ordinary words that could be brute-forced very easily. I haven't read anywhere that anyone has lost coins on a coldcard with a strong unique passphrase (so far).

Passphrase can potentially add strong protection to their wallets, but this is only for those people have great understanding on how the wallet they are using works.

The real risk is not about the feature, but rather on how the user done set set up or how they handle it. Adding it could be a risk if they don't know how to safekeep their phrases or they don't know how to handle then suddenly expose it to somebody else then also they lost it due to negligence.

When choosing a passphrase, picking those what they think easy to think or guess defeats the purpose of having this feature. Because they can easily got compromise with that situation. Better for people to erase that convenience thought and pay attention to make their wallet became more secured. Since if they know how to handle their wallet that passphrase became a additional strong defense of their wallet.

It is logical not to use passwords that would be entered on such sites, even though they claim that they do not store them anywhere. Such pages actually serve to give the user insight into the best way to set their password, which of course should be unique for each service they use.

I would just add that even the strongest password has no purpose if someone's computer is infected with a RAT (remote access trojan) or if they have a keylogger on their computer. The first step is to maintain good internet hygiene, if possible have a good antivirus + firewall and if possible use Linux instead of Windows.

A two word passphrase does not tell us anything, it could be as weak as something like "bookhouse". A passphrase needs to be reasonably strong enough, not too weak and not extreme and then it is fine. As I said it only needs to provide enough time to do an intervention in a case like this so that the user can create a new wallet and move the funds over safely, without any kind of rush. We can subjectively debate how many days or weeks this should be because there is no clear answer. Even if you have a strong passphrase, I would not continue using a wallet that has a severe exploit in its base random number generator. The details of every case matters, and we have to be careful in how we are writing the suggestions to defend against cases. I've seen so many people lose backups over the years because they were complex or not done properly or not tested at all, reasonable and verified is better than complex and rushed.

In those cases it would not help at all whether someone enters the password or not on a website that is storing them or if their keys are being logged. Users must be very careful not to create a complete system compromise like that because they can try to be subtle and the attacker may not do anything that could show that he has infiltrated the system.