Technically, even just plugging in a usb device is a security risk, no need to actively install shady stuff or anything. Is that option heavily utilised in the field? Probably not, but who knows.
So, instead of trying to figure out how to harden your daily driver, you might consider just getting any cheap phone/tablet with a half decent screen.