I think the paranoia stems from the HID inserting winflag+r, powershell curl https... which installs keylogging software. It can do that after a 10 minute or so countdown timer so it might not seem immediately obvious, or might seem like part of a auto-update with powershell postinstall.

The paranoia stems from this being a suspiciously cheap device that is meant to be ordered in bulk from China.