@convexer @xssfox WUOT ZE FECK?
Serioisly, they should get that thing replaced as it's obviously compromised.
Consider gifting them a @nitrokey ?