looks like there was a USB vuln between 4.0.0 and 4.0.1 that would be referenced to. given USB as the threat vector, an air gapped setup would not be affected. I don't believe he is complicit based on...
I don't know, if I would call it complicity, just that he wouldn't understand the repercussions of why his guide would be important. It would however be foreknowledge.
1