The recent versions of Android seem to have gotten way better on ADB security. It seems to generate a keypair on every computer with ADB and require a user with the unlocked phone to authorize the keypair for each device manually. It also auto-revokes authorization if you haven't connected that device with ADB in 7 days by default.