Coldcard is not "Open source"

The firmware source code is publicly available and can be inspected, However, Coinkite changed the license from a standard open source license to one that includes the Commons Clause, which means it's source available/verifiable rather than OSI approved open source.

Also Coldcard uses two secure elements (the Microchip ATECC608 and Maxim DS28C36B on newer models) to protect your seed.

Those chips are proprietary hardware. Their internal designs and microcode are not open source, and you can't audit what's inside them. That's true for virtually all commercial secure elements.