Additional question: This user has the usbcore.authorized_default=0 in their /etc/qubes-rpc/policy/qubes.InputKeyboard.
Can that be right? The file has the format <source> <target> <rule/options>.
However, in the Manual Setup for USB Keyboards, the footnote in the bottom (for Qubes 4.1), it seems to be talking about the qubes.InputKeyboard file, and then in the following section Qubes 4.1: How to enable a USB keyboard on a separate USB controller, it is explicitly stated that it goes in /etc/default/grub.