Once you reprogram the monitor, you can store or exfiltrate all of the data the user sees, and do clever things like erase and redraw the mouse pointer, or draw new prompts, to induce the user to click on the things they wouldn't have otherwise.

An attacker swapping the monitor with one that records or displays other content isn't very different from the possibility that an attacker replaces your keyboard with one that keylogs or inserts crafted sequences of keypresses. I don't think ORWL tries to do anything about these possibilities, and it's difficult to imagine good fixes that don't massively change the scope of the project. And even if you do make the keyboard and monitor tamper-proofed and securely paired with the ORWL, it can't prevent an attacker from hiding a video camera in the room or using skimmer-like devices between the user and the devices.

Or the one I coinvented and described before the leaks:

https://www.schneier.com/blog/archives/2014/03/ragemaster_ns...

There's no direct solution to the subverted monitor problem that I'm aware of. You basically get them from random places under different names or from people unlikely to be spies then use I/O protection both ways. Same with most hardware you can't produce yourself. There's potential to market something here where the monitor is immune to code injection, does I/O filtering, can't store anything, and does these with visually-inspectable chips & board. Add TEMPEST shielding while you're at it since that's an existing market that will drop lots of cash on improving security. See EMCON's products for examples.

EDIT: Forgot to mention that spectrum analysis is often used to try to catch radio emissions. There's techniques to tell if monitor sends out stranger than usual signals. That's just kind of limited and doesn't help if it's black bag job where person can show up twice (eg maintenance person).

The VGA/DVI connectors have DCC pins for getting the monitor information. I've seen this connected to the SMBUS in the computer so it might be possible to gain access by hacking through the DCC pins on the video connector.