In a multisig, only one xpub of a member is required to track *spends*. (Compared to all of them for unspent outputs, which is why you MUST back it up to restore your wallet) This is because the individual pubkeys derived from each member xpub are revealed on chain, and you could just check using one xpub. Someone can bruteforce all possible seeds’ multisig xpubs to track individual wallets.

So do you believe they're lying when they say K4, K5 and Q are unaffected or does it look like legitimate ignorance? I understand I'm asking an opinion on a fact post but these two premises conflict.