I mean sure, but in that scenario you can swap a keyboard for one with a built-in keylogger, no need to bother with some ultra-complex ram bumping TB3 devices. If the attacker has physical access to your machine, all bets are off anyway.
Right but in a office environment we could be talking about drive by attacks where yes someone has physical access, but not enough time to be able to disassemble the machine and replace the keyboard without anyone noticing.