I love QMK, but I do worry about the physical security of a keyboard running a flashable firmware. It would be so easy to snarf passwords off of one, even less detectably than by installing a keylogger.