Or a contractor can take it home, against policy of course, and then it gets submitted to an online anti-virus scan.

Or it gets left on a USB key in a taxi

Or it gets left on an un-scrubbed laptop that's put up for government auction.

Or any of the other which-ways that humans get around policy limitations that don't have technical barriers, or socially-engineered to get around the technical barriers.