There is a linux service/rule that runs on boot and after every add trigger of udev that applies group rw to input devices.
The udev rule applied by hhd to hide the controller runs chmod 000 after the rule application, which overrides it. However, on boot, the service/rule starts/is applied after hhd hides the controller, resulting in the controller not being hidden.
Identify what this service/rule is and make hhd run after it.