They do nothing.

You need to explicitly mount (in your ChromeOS settings) any USB devices to the Linux system. Other than that I'm not aware of any specific mitigations.

So if I plug in a usb keyboard or mouse, they do not work until I activate them in settings? Sounds like an easy way for grandma to buy Dell over Google

In the Linux environment specifically. The average user is not using the Linux environment, it has to be enabled in developer settings.