The FAQ on their website should answer your question:
Yes. Opendime is delivered without any private key. You must give it entropy (random numbers) the first time you use it. Once it's gotten enough numbers, it will hash them all together and use that to pick a random number to use as the private key. At that point, the payment address is generated and set in stone.
This whole process is very easy: just copy some files into the USB drive. When it's got enough bits (256k bytes) it will eject itself and come back with its final payment address.
On top of that, you could unseal and get the WIF (private key) offline and never connect the Opendime to anything after that. Since the OD does not connect to the internet, it's not possible for it to move funds without you