tl;dr don't plug unknown things into your computer.
Separate built-in device, or specific signal sequence inputtable on the IME the device registered itself as e.g. if you plug in something which advertises itself as a keyboard, the system sandboxes it and asks that you input a specific password which it displays; for a pointing device it might ask you to move the pointer to specific places and click on them.
Allowing the first keyboard after boot by default seems not unreasonable. It would still make it possible for evil maids to plug in something and wait for you to boot up again, but they are difficult to protect against anyhow. This would also avoid the hassle of vouching for your keyboard every time you reboot.
Then for any USB input device that's plugged in another physical socket (e.g. where you'd plug things that you believe are just mass storage) the OS can require acknowledgement from the user before it is connected and allowed to send input data.