Hypothetical: If one of the major hardware wallet companies found a cold card-type vulnerability, what could they do that wouldn't alert hackers?

Like, if there were earlier versions that made weak seeds, if they made it public, hackers maybe could figure it out, and there's no way to 'update' the software to fix that, people would have to create new seeds and send it there.