Scenario: (2 of 3 multisig) one of the hardware wallets is running malware and uses an attackers xpub instead of the one derived from the recovery phrase. This swapped xpub is reported to all the other cosigners and the software wallet. All signing devices corroborate that they are all using the same set of xpubs, and that their respective sets of receive addresses match those displayed on the software wallet. But the funds sent to these addresses do not belong to the owner, as their redeem scripts were created using an xpub the owner does not have knowledge of.
If the owner were to wipe the devices and recover their multisig setup on a new set of devices free of malware, they would be shown a completely different wallet with empty addresses. In order to recover their funds they would need the missing xpub from the previously malware infected hardware wallet.
Question: If this scenario is possible, isn't multisig actually less secure than single sig, since a single malware infected hardware wallet still compromises the entire setup, but now instead of an attack surface of 1 hardware wallet, you now have 3 (from different brands with different vulnerabilities) that can be compromised?