Doesn’t even have to be the key necessarily. Could get in via some exploit first. Either way taking over the machine became a 2-step process.

I don’t know the support model for Framework but they should really be able to work through these issues for such a common distro. With the various things you mentioned it doesn’t sound like bad configuration, it sounds like a hardware issue. Given that Windows is so different from Linux it may be the case that Win11 does a better job masking the issues.