I'm not an expert. From what I can tell on my phone, USB interface isn't available unless developer options are first enabled, and then USB debugging is enabled

I'm not an expert. From what I can tell on my phone, USB interface isn't available unless developer options are first enabled, and then USB debugging is enabled, and the phone is unlocked, and then once an initiate USB connection is made the user needs to acknowledge the host USB trying to make a connection which requires the phone is unlocked to see and acknowledge the request. So, offhand I'm not sure to what additional degree a user is at risk if they have developer options and USB debugging enabled, if they're also unwilling to hand over their unlock code. Obviously if neither debugging nor developer options are enabled, they can be trivially enabled once the unlock code is entered.