Yes, this. It's good that the mouse, by default, only returns dx/dy/buttons. It's bad that you can't reprogram it easily if you want to and it's bad you can't view the source code of how it works.
I expect reprogramming to require a JTAG board. Easily reprogrammable (via USB) peripherals will be a malware vector really quickly.