1. You can avoid inserting anything before the OS boots up.
2. You can disable booting from USB in the BIOS. However I think you can't disable keyboards there, so a badUSB device can potentially enter the bios, enable USB booting then infect the machine by booting into the virus. Disabling USB booting and setting a strong BIOS password can be safe, I would still prefer the first option though.
Circlean seems to run on RPi - that won't boot off USB by default. In fact, you have to jump through extra hoops to get a similar effect, such as "bootloader runs from SD card, then explicitly switches to USB". So unless the makers of this have deliberately implemented this vulnerability, it's not there.
Oh, you are right, this can be bad. But I doubt that CIRCLean does any of the badUSB mitigations. They could fix all of these including the instructions. But that they copy unrecognised binaries ("Octet-stream" in their readme) without marking them dangerous is the most worrisome for me [1]. It seems to be useful only for office documents.
