We're trying to solve the problem of how to point periscopes here, not solve the generalized problem that when it comes down to it, nobody really knows what 2027 is going to be like.
(By contrast, "this is a new vector for malware if the supply chain is not secured" is a valid concern because one presumes and/or hopes that bespoke military hardware is better controlled there. This is a solvable problem, but solving it eats into the cost advantage.)
Further more, I agree with your parenthetical that the malware angle is the more important argument. I disagree that it's a solveable problem though, but I feel the Xbox controller isn't the reason it isn't solvable. Any platform can be hacked given sufficient motivation.
Honestly I think using these controllers are likely the best approach, but let's not pretend it doesn't have issues (it's just the it's the same issues or less cumbersome issues than alternatives).
The Navy can buy thousands of Xbox controllers for the cost of even a single bespoke controller. The US has on the order of 100 submarines. Replacement controllers for the lifetime of each submarine -- even multiplied by 10 -- is a hilariously small cost compared to the alternatives.
So buy 1,000+ Xbox controllers and keep them in a warehouse. Problem solved.
Yes, I was going to suggest this. It would solve the availability issue and reduce the malware issue. If it's replacing a $38,000 item, they could buy 1,265 extra per sub.
First of all, I want to say I agree with you. That said, you didn't really refute GP's point.
The IBM XT was well documented, had many clones and alternatives, but still you can't find parts at most electronic stores 33 years later. Several decades is a very long time in consumer electronics.