Limited attack surface is not acceptable for a device inside your brain.
Neuralink has actually no responsibility to tell you their whole security architecture. They are presenting this for recruiting and showing the public some of their progress.
When they bring a product to market, that is.