They address this a bit. Their CPU supports device virtualization and the default OS install dedicates a VM to just the USB ports, and the USB data lines are el

They address this a bit. Their CPU supports device virtualization and the default OS install dedicates a VM to just the USB ports, and the USB data lines are electrically disconnected from the HCIs when the machine is in locked mode. I'd be more concerned about the wifi and bluetooth chips' firmware.