Honestly, if the victim thinks it's legitimate and they've plugged it in, autoplay being disabled is no big deal to the attacker, chances are, they're going to

Honestly, if the victim thinks it's legitimate and they've plugged it in, autoplay being disabled is no big deal to the attacker, chances are, they're going to double-click the setup.exe/install.exe anyway...