How would you sandbox such dumb "actions"? Draw a copy of everything afflicted by the actions of the thumbdrive- and kick the container, once it touches the system in a bad spot?

We are talking about tradeoffs- and the truth is, we traded security for development speed and low price, because security has a tendency to arrive very, very late in the game, the moment people want to abandon the system or concept.