Remember that zero BTC was lost from multisig setups in the Coldcard incident, whether they had a passphrase or not.
A passphrase is not necessary in multisig. Adds complexity and a foot gun to your setup that actually makes it less resilient. Without a passphrase you just need the hardware wallet, with it you need both, and it’s a lot easier to lose a passphrase than hardware.
Multiple keys gives you enough protection.