I have the external wireless "ThinkPad TrackPoint Keyboard II"
(https://www.lenovo.com/us/en/p/accessories-and-software/keyboards-and-mice/keyboards/4y40x49493).

With this keyboard, middle-mouse scrolling *also* sends a middle-click,
which often has the net effect of triggering a paste in addition to
scrolling. This has the potential for unwanted information disclosure
(e.g. passwords), hence the severity.

In the past, with a different keyboard (a wired external ThinkPad
keyboard), middle-mouse scrolling avoids sending a middle-click, and
thus avoids triggering things like middle-mouse paste or opening a new
tab.

I don't know if this is an issue with the handling of this model, or an
issue that changed in libinput.

- Josh Triplett