I guess you could potentially make a device that appears to be a controller and translates keyboard/mouse with a couple USB inputs
They control the console, the OS, the controller hardware, and can require the console to connect to them. They already have the ability to push out controller firmware updates. They can have the controller cryptographically authenticate to the console and push blacklists to the console of keys that get leaked (like if someone somehow extracts a key from a legit controller and uses it to make a knockoff).