I would be cautious about discrediting intuition as paranoia.

2. Isn't this scenario incredibly suspicious?

> They could have simply moved things on the desk.

Is there any evidence suggesting something else happened?

Memory forensics would have 100% given you evidence that it was accessed and exactly what was done. There are plenty of guides on how to forensically dump memory but that depends on the OS.

But I'm also in this is FUD camp. I highly doubt any company would do such a risky thing such as mirror your machine data merely for an interview. This would be highly illegal and damage the companies reputation for a relatively minor benefit.

Especially when interviewing any software dev which any infosec person would assume they are dealing with a sophisticated target with a high chance of being detected. Meaning they would have to use very careful cloning techniques.

It would be much easier to get you on staff on a company machine and temporarily monitor you closely after the fact. There are plenty of ways to thoroughly vet someone beforehand without taking such a risk.

This sort of penny-wise-but-pound-foolish shit is depressing, but not nearly as rare as I wish it was.

If a place is worth working for they're not going to judge you for feeling more comfortable keeping your stuff with you.

Isn't this only possible if the laptop is unlocked?

Reputation is everything.

(Except this one, of course. To be fair it was Otto before the acquisition)

Even you could do it https://www.youtube.com/watch?v=qGPGOoJn54E hint: there are internal USB buses in the macbook, you can hijack one for something like rubberducky +management circuity to trigger only when laptop is powered on for a longer period of time but not touched (no imu/keyboard/touch events/dimmed screen).