Could request unlock and reboot if no valid pass is accepted within n minutes.

Better wire it up to a thermite charge just to be sure. Untrusted USB device? Hope you enjoy 1400 degree molten iron

that doesn't seem unreasonable. You only have one first time. Maybe two if you upgrade your computer more often than your phone.

1. disable shutting down. 2. connect device and fingerprint it. 3. enable shutting down

Yeah... that could be an option you configure.

Or it’s not enabled by default.

TBF pretty much no one connects their devices anymore to anything other than charging. For those who do some timeout could work.