They're great but there's gaps. You pull your seed out every time you sign. No secure boot, it'll run whatever's on the SD card. And no anti-exfil, so dodgy firmware could leak your seed through your signatures and you'd never know. Always check your image.