Here’s how Arch fixed it:

[Service]
ProtectHome=read-only
PrivateDevices=no
DeviceAllow=/dev/urandom r
DeviceAllow=char-hidraw rw

According to a comment on the related polkit report ”That’s the correct way to solve these issues”.