Earlier this year I made a comment here on LinkedIn that a few security people took issue with. The AV industry needs to make a case for DisplayPort Alt Mode surviving robust endpoint security policy. A blanket lockdown takes down the room when the USB-C port is completely disabled.
The confusion starts with what Alt Mode actually is. It is not USB data. When a computer drives a display over USB-C, it is repurposing the USB-C high-speed lanes to carry native DisplayPort, with Alt Mode discovery and configuration negotiated through USB Power Delivery. A policy written to stop someone walking out with a drive full of files doesn't have to also block the image on the screen, and it doesn't need to block the camera or the audio either, because those come up as their own USB device classes.
What actually takes the room down is the broader and cruder security approach. Blanket port disablement at the BIOS or through some endpoint controls can kill everything on that connector at once. Class-level rules that sweep USB audio and video in with mass storage and networking remove exactly the classes a camera and audio system depend on. The displays go dark, and the integrator gets a call. The security policy that caused it was written about storage and networking, but AV became the innocent bystander.
The IT team does have cause to worry about USB-C. The converged USB-C port is a real attack vector. BadUSB firmware can make a thumb drive present like a keyboard and type commands no one approved. On machines running Thunderbolt or USB4 over the same connector, DMA-class attacks are a genuine exposure. A security team locking the port down is responding to a real threat.
So the ask is not that IT stop applying security policy to USB. The connector is the wrong place to draw the security boundary. A malicious device can claim to be a class you allowed, so class alone does not get you there. Put the control on the devices and functions using the port. Block mass storage, network, and unapproved peripherals. Windows device control can already allow and deny at the device ID and instance ID level, Linux does it through kernel USB authorization and tools like USBGuard, and macOS covers it through MDM and endpoint agents. Granularity varies by platform, but a layered policy that blocks broadly and permits approved hardware is enforceable today.
Allow the AV classes and the approved devices the room actually requires, and leave DisplayPort Alt Mode alone.