They could use AVF pKVM for this (which'd require a partnership with Google) but that of course requires locked bootloader + remote attestation..

So actually, I hope they're just lying..