If a good hacker or I get hold of your seed phrase with 4 to 6 random words, just know that your bitcoin is gone because I will be able to access the bitcoin. A hacker can steal the cryptocurrencies of the seed phrase within minutes. For someone like me, just know that it is not really different than not using passphrase. Make sure that you use a long characters, add numbers and other characters to it. Use at least 15 characters.

It's complexity Vs best security, only you can choose which one suits you the most, I personally will avoid complexity because there is a high chance of doing something wrong that can lead to lose of assets.

Instead of going fully multisig don't forget that you can keep your recovery seed offline and still use passphrase to make it more stronger, it doesn't have to be multisig.

After this coldcard incident happened recently, I think adding a passphrase is enough, although I haven’t done it yet (because I’m lazy). Adding more things is both confusing and tiring. Ofc techie people can do whatever they want, like rolling dice etc. But it’s too much for a random person. I (who am not good with tech) already have a hardware wallet with seed phrase, and I try to keep it safe. Now I will add a passphrase, and that should be enough for me. Doing things more than this scares me. 

Considering what is happening of recent how wallet are being hacked and funds are being transferred from one wallet to the other by the hackers, it is more wise and safe to consider the use of a multi-sig wallet, even in such a way that if your private key gets compromised, hackers won't be able to penetrate through your wallet and perform a transaction successfully because they will need a cosigner which is very obvious that they cannot have access to sign the transaction, it is also recommended that one should consider the use of passphrase, and wallets that support this are also good for use.

Hmm. I don't think it's worth it unless you are an organization, as the other members have said.

Personally, I would approach this as Shamir Secret Sharing. ^{(Having one seed but split into pieces)}
Maybe this is the approach some people are looking for?

Multi-sig doesn't require a strong memory, it just has a complex set-up and signature requirement for signing transactions that makes it discouraging, but I prefer it for long term storage since I wouldn't be doing much transactions frequently on the wallet address. If you are a regular user that spend Bitcoin every time, a single signature wallet should be able to give you the best security at any time, and if you wish to add a passphrase you can remember, then that's better.

 
The wallet attack happened for almost 2 days before many people were aware, some were lucky because the attacker focus on defualt wallet derivation of first accounts on Coldcard. Some people kept their Bitcoin Acoount 2 and other different accounts without passphrase and later moved their coins before the hackers.

First of all no one can access my seed phrase. Okey let's think you access my seed phrase how will you bruteforce my passphrase?
6 truly random words from a dictionary (like the EFF Diceware list of 7776 words) provides over 77 bits of entropy (7776^6). If your or hackers device can check 1 trillion times/sec approximately
~8,700 years will take to get to my original passphrase.

Multi sig is quite complex to use because you would always need your seed phrases and the wallet descriptor file in order to recover you funds and if the descriptor is lost, then that's a whole headache altogether and that's why using single sig plus passphrase is simpler and better for management of small portfolio and passing on portfolio inheritance to another person in case of maybe death or a very critical condition.

Still, I can't dispell how important using multi-sig is because, when one has accumulated enough Bitcoin or other crypto currencies over the years that amounts to much, hardware flaws or theft could easily occur while using a single sig plus passphrase and that's where I consider multi sig setup most efficient for larger portfolio holdings.

Ok, I get it. But I still think this can be true in 2 of 2 multisig if only both public keys have not been exposed yet. But if it has been exposed, don't you think an attacker can brute force the public keys independently and maybe in parallel ( that is at the same time with two different quantum computers) to derive the private keys.

Yeah, your suggestion provides additional layer of security because it will cost more resources to execute but I think the attacker can spend such resources provided that the amount of coins at stake is worth it.