The private keys are already “exposed”, just a matter of time until they are released or sold. As far as I know exposing the xpubs would allow anyone to derive the addresses. Not sure if somebody would be able to do anything with them.

Can some good soul generate all possible xpubs so ppl can verify if they are in danger? #bitcoin #coldcard

I am not talking about address being drained. This is pretty obvious just looking at my wallet. The point is, some ppl might have a passphrase which can hold the funds for a while. But its just a matter of time until they start bute forcing the possible private keys. Exposing the xpubs would be easier to check if the funds are in danger.