For the simple case (wire up an additional USB hub and a USB-flash-drive into the mouse body) that's easily done (under Linux, lsusb would suffice). But if you

For the simple case (wire up an additional USB hub and a USB-flash-drive into the mouse body) that's easily done (under Linux, lsusb would suffice). But if you allow arbitrarily complex logic to be present which only activates additional functionality on the presence of an arbitrarily complex trigger, you can no longer proove the existence of this additional logic. As an example: Maybe my microcontroller passively watches the mouse, and only activates the payload (routes the mouse signals through the USB hub and activates the flash-drive) after a complex sequence of mouse-moves and clicks have been performed? The trigger might be to monkey-train the unsuspecting user with a specifically crafted flash-game on a frequently visited website.