a) Can the hacker steal all the coins in the wallet without access to the 4th seed and without any knowledge of which addresses belong to the wallet?
Just make sure that you yourself also have access to all the public keys.
Because essentially in a 2-of-4 scenario like you said, if you have 3 keys but don't have the 4th XPUB, it will be like knowing 3 keys that unlock 4 doors, without knowing where the 4th door is.