Yes, if this is programmed badly (missing security or a security hole). The browser connecting to the government website accesses two servers: the original one

Yes, if this is programmed badly (missing security or a security hole). The browser connecting to the government website accesses two servers: the original one and the second local one you install yourself on your system. The local server runs natively and therefore can access the USB device. Like all servers it should be programmed such that misuse by hackers is prevented.