Comment by zb3

It physically disables USB ports when locked which significantly reduces the attack surface + can be configured to automatically reboot.