you could sweep the funds yourself and return them minus a finders fee.

re "A seed generated on a flawed Coldcard is permanently weak, so responsible disclosure had nowhere to go."