Anyone with the knowledge of a seed phrase has complete control over the funds stored with that seed phrase. It is not safe to use, and any transactions made with it in the past can be linked together as belonging to one wallet, that’s all. I am not sure why someone malicious (as you call them) would send funds to a seed phrase they know is not under their complete control, since you could easily sweep them to yourself.
As an example, I went to https://iancoleman.io/bip39/ and generated this seed phrase:
fabric nice tissue private subject decrease crazy repeat illegal pulp depart reward
Since I’ve shared it here it is now insecure and sending any funds to an address associated with it (e.g. bc1qq6hkw49wexxsd4n3avfwjkc06fejdwlxgxzqcq) means someone else will eventually take them. But as long as I don’t use this seed phrase in the future, I have not compromised my security in any way.
