Hehe. Or they could send a 0 to your fan velocity. Or flash/lock (setting the flash bit to 0) your BIOS through ACPI calls. Even stolen your Steam token credential. I saw an example that runs commands as a Systemd volatile user service. There are a few POCs on GitHub about recovery passwords from the browser (sand-boxed environment) for generic environments. I think that everyone here is old enough to understand the consequences of our acts.

Ideally yes, though it would probably also require a reboot to apply. Realistically disabling security mitigations should only expose you to risk when you execute untrusted code (e.g. load a website, run an untrusted program, or etc.), but there’s no way of telling if someone could connect to your system using an exploit and then abuse those hardware security flaws.

Consider your own risk tolerance – is it worth it to you to get that extra few % of performance and risk someone gaining access to information on your Deck (and/or using that information to access other sensitive information)? It might also be worth mentioning that most games aren’t 100% trustworthy since we don’t exactly know what they’re running since game studios don’t share their source code.