I get why general hardwired USB is a security risk. But if you control 100% of the hardware, as with Coldcard, why can't you just support the most limited subset of USB functionality, and not allow it to do anything weird?