So this isn’t really different from having a USB cable: in either case, some untrusted messages arrive at the secure element over some wires, and get processed there. The only difference is that the wires come from another chip on-device rather than from an external cable.
[0]: https://www.ledger.com/ledger-nano-x-bluetooth-security-mode...