I think the paranoia stems from the HID inserting winflag+r, powershell curl https... which installs keylogging software. It can do that after a 10 minute or so

I think the paranoia stems from the HID inserting winflag+r, powershell curl https... which installs keylogging software. It can do that after a 10 minute or so countdown timer so it might not seem immediately obvious, or might seem like part of a auto-update with powershell postinstall.