The extension pack isn’t though: it’s closed source and only free for evaluation, personal use, and educational purposes.

No USB passthrough in VirtualBox without the extension pack. And unless you have a paid version it is a license violation to use the extension pack in a commercial setting. Take that with a grain of salt: it’s from the top of my head and it has been a while (years) since I touched VirtualBox. Since you are concerned about privacy, I’d suggest not touching closed proprietary software, like VirtualBox, at all whenever possible. Luckily, for virtualization in linux, that is perfectly possible. What you will want to look at is kvm/qemu. And maybe a handy UI to that like (qt-) virt-manager or gnome Boxes.