because the report code might have bugs

If it were transmit only, you could put it behind a data diode and buggy report code wouldn't matter. Even better, validating the code is a lot easier if it doesn't accept attacker input.