How to prevent a portable OS from booting via a USB C port on my Surface Go 2
Modern computers (and including your Surface) have a BIOS (UEFI) setting called Secure Boot.
Make sure Secure Boot is set to Enabled (ON).
That prevents starting with a portable operating system.
This was done by manufacturers (and Microsoft) to stop this practice of starting with another OS on a portable USB key.