Y
If your monitor is compromised, there are several possibilities.
Video Capture
This is the most obvious choice, but would require hardware customization. In essence, the video streamed to the device would be (possibly compressed and) written to some kind of internal storage, or streamed to a remote recipient.
This would mean anything you see on your monitor, the attacker could see as well. This means communication to other people would likely be compromised, but your online accounts would likely not be, as most login forms mask the password on entry. Only the length of the password would be disclosed. I could tell you that one of the passwords I use is 41 characters long - that's really not an issue to me, but it might be to someone who uses short passwords.
Keep in mind that this would be a purely "passive" attack, so an attacker can't affect what they see. They just happen to see what you see.
Attacks via HDMI
HDMI is quite a complex interface, and includes things like Ethernet and ARC (Audio Return Channel). In general, HDMI isn't just a one-way communication from computer to monitor, but a two-way communication.
Therefore, it is possible that the interface in your computer, be it your graphics card or motherboard, has a vulnerability, which can be exploited via these interfaces.
Has this ever happened in real life? Not that I am aware of. This can mean one of three things:
It hasn't happened yet.
It has happened and was documented, but I couldn't find it.
It has happened, but has remained undetected or undocumented.
One of these three is very likely.
Note: The same thing would be possible via USB-C monitors.
How to mitigate?
This is one of those "choose your level of paranoia" things. On the "not paranoid" setting, my recommendation would be not to worry about it. I know plenty of security folks, and no one ever mentioned being worried about monitor firmware compromise.
On "slightly paranoid", I would recommend not ordering monitors online, but instead buying them from stores. The reason being that whoever might want to look at your screen or attack your PC wouldn't know which one exactly you'd buy, and planting all monitors in a store would make it more likely for the attack to be detected.
On the "very paranoid" setting, don't trust any monitor at all. Assume everything yo see on the screen, the attacker also sees. Assume no communication is private. Who needs practicality when the skinwalkers are stalking you?
