Further more, I agree with your parenthetical that the malware angle is the more important argument. I disagree that it's a solveable problem though, but I feel the Xbox controller isn't the reason it isn't solvable. Any platform can be hacked given sufficient motivation.
Honestly I think using these controllers are likely the best approach, but let's not pretend it doesn't have issues (it's just the it's the same issues or less cumbersome issues than alternatives).
The Navy can buy thousands of Xbox controllers for the cost of even a single bespoke controller. The US has on the order of 100 submarines. Replacement controllers for the lifetime of each submarine -- even multiplied by 10 -- is a hilariously small cost compared to the alternatives.
So buy 1,000+ Xbox controllers and keep them in a warehouse. Problem solved.
Yes, I was going to suggest this. It would solve the availability issue and reduce the malware issue. If it's replacing a $38,000 item, they could buy 1,265 extra per sub.
We're trying to solve the problem of how to point periscopes here, not solve the generalized problem that when it comes down to it, nobody really knows what 2027 is going to be like.
(By contrast, "this is a new vector for malware if the supply chain is not secured" is a valid concern because one presumes and/or hopes that bespoke military hardware is better controlled there. This is a solvable problem, but solving it eats into the cost advantage.)