In a theft attack, a compromised computer wallet provides fake cosigner xpubs to the hardware wallet. For instance, in a 2-of-3 multisig, the compromised wallet might provide two xpubs controlled by an attacker. Funds sent to the resulting address would then belong to the attacker.