The maid could even install a USB keylogger, if the goal is compromising just the credentials.
Unless you're willing to go full iphone/xbox with no third-party hardware or OSes.
And even then, you still have the entire 1st party OS attack surface to play with. Which is just _huge_ specially considering this evil maid scenario implies you have a large amount of time with full control of the device itself and all its hardware.
These evil maid scenarios are so academical in nature by now, that there is practically no way to defend against them outside academia itself.