Public companies have disclosure requirements, and sure for security purposes they might not disclose all of their custodians, but I am pretty sure that they have to use qualified custodians, and I am pretty sure that the topic of the custody of MSTR's coins has come up from time to time over the last 3 years, and how many specifics that they gave may be contained in their quarterly reports and I am sure that they are giving as much as they need to give legally.. but sure the questions of their adequately securing their coins could become a question of concern, even though they did seem to survive the 2022 situation in which several custodians were shown to have been irresponsible with their coins.
One interesting aspect is that, as far as I know, they are giving their Bitcoin to a single custodian (I will let you discover in the thread which one I am talking about).
On the contrary, I know other companies have made the exact opposite choice. The rationale is that, yes, spreading the custody over multiple custodians actually increases the risk of being hacked but diminishes the expected value of the loss, and this allows the enterprise to survive in such an event. No matter how tiny the chance of a hack to a single custodian, it puts the firm's existence at risk because a single point of failure is a no-go.