You cannot trust internal generation anymore. And I have doubts about “simple passphrase is enough” thing. After the incident I would recommend to stick to the dice rolls plan

If Ledger uses the TRNG ship like they say they are. Then you're as safe as you can be, some people would say the dice generation method is even more safe, I'm not a mathematician so I can't tell, but TRNG ships are used by the banking system, so you can imagine it's totally fine. About the code not being open source, and knowing coldcard code was open source, letting AI checking it and maybe finding the flaw, I can't tell if that's a bad thing. Before AI it was a good thing to have open source, so nerds could check if there was shaddy things there, but today, I'd probably defend the closed source way, idk.