I don't think that would have protected against this attack. I think it was the users' workflow to plug USB drives into non airgapped computers, then into the a

I don't think that would have protected against this attack. I think it was the users' workflow to plug USB drives into non airgapped computers, then into the airgapped computers. So those USB drives would be put on the approved list, and also be used by the attackers.