I've setup a 2/2 multisig wallet on Electrum and cosigned it with a hardware wallet (Ledger).
From what I've understood, your keys never leave the hardware wallet when signing transactions, correct?
Yes, that's right, the private key is stored in a secure chip hardware wallet.
And since if I try and make a transaction on the electrum multisig wallet, I still need to sign it with the hardware wallet then broadcast it; it is an added security. Is my understanding correct?
Yes, that's correct. You still need the hardware wallet to sign transactions on the previously created multi-sig wallet.
If so, are there any possible vulnerabilities in this setup? A possible means of someone accessing the multisig wallet I've setup and actually spending the coins, without access to the hardware wallet.
He still needs a hardware wallet (or private key from the multi-sig address) to access the multi-sig wallet and all cosigner access from each wallet.
Also, if the hardware wallet gets lost, I wouldn't be able to spend the coins too unless I restore it on another device. Correct?
Yes, that's correct; You can restore to another hardware wallet;
When creating a new multi-sig wallet, make sure to use the Master Public key that you previously used so you can reaccess the wallet address on the multi-sig wallet you created.
Sorry if I sound dumb, I tried searching specific answers and couldn't find any and as you know, some sources also cannot be trusted so I think it is better to get answers here instead.
The following is one of my practices when creating a multi-sig wallet using 2 Electrum wallets + 2 Hardware wallets on different OS and devices:
https://bitcointalk.org/index.php?topic=5392586.msg60534500#msg60534500Multi-Signature Wallet using the Electrum and the Hardware Wallet.
-snip-
Wallet 1
Wallet: Electrum Testnet 4.0.9 (macOS)
Hardware wallet: Trezor T
Wallet 2
Wallet: Electrum Testnet 4.0.9 (Windows OS)
Hardware wallet: Ledger Nano X