iirc knowledge of any deterministic private key compromises whole seed, all addresses
The seed is "compromised" in a sense that some information about it is revealed. But the seed is not revealed itself. That is the whole reason to use HMAC in keys derivation. There is no known method to derive other siblink private keys in the deterministic wallets, i.e. no way to steal BTC. You can derive children nodes in the hierarchy, but those are not used for anything.