The ZERO has a built-in USB-C port that can be used only for charging & firmware updates.
Firmware updates will be available through the NGRAVE website and will be cryptographically protected.
Moreover, the USB-C port is both isolated for security reasons from the rest of the device, but it is also protected by the EAL7 certified secure OS. This means it has passed the most extreme security tests, up to a level higher than average banks and governments (which are typically EAL5 certified).
Your security is our greatest concern.