What can 1 master public key in a multisig reveal?
From a security perspective related to spending bitcoins, since only the master public keys have been compromised, there is no way that the attackers can derive the child public keys as they do not have access to the chain code. However, if the chain code is also revealed, there is no way to derive child private keys and hence the attacker cannot spend the funds. So if you are trying to create transactions with 1-of-3 or 2-of-3 multi-sig, the attacker still does not have access to the signatures (since he does not have the private keys)

However, if you are going to create a P2SH address of all the 3 public keys involved, there is no way anyone can recreate this address even if they know the 2 of the 3 public keys.