[gruez]

>or dual-boot (less secure).

There shouldn't be any risks to that if your main OS is encrypted and the keys are sealed by a TPM.

[blattimwind]

The untrusted system could flash malicious firmware to a component with DMA (e.g. GPU VBIOS) to infect the second system.