Happily, that can't spread via malware - and would be visible to the user, though a long delay could possibly avoid that (is there any way for a device connecte

Happily, that can't spread via malware - and would be visible to the user, though a long delay could possibly avoid that (is there any way for a device connected via usb to figure out when the computer is idle?). But yes, when you plug something in to your computer, you are explicitly saying that you trust that it is what it claims to be, before even thinking about what nasty things it may be holding in its memory. Or whether it may be wired to short out the usb port, or the computer it's attached to.