Oh, no, the nfc card is just empty. The idea is that they use some Nost client and generate their own keys obvously, but have a way to back it up.
As for password bruteforcing...well, yeah...whatever. you can add some password best practices on the letter, but with these things i think you should not overthink it. Its just so that if someone grabs your card you are not instantly pwned as would be the case with a raw nsec
