Never underestimate the distribution of stupid. I worked at a hardware / software company where management distributed USB drives as a reward for something or other. The USB drives weren't even in blister packs they were just loose in plastic envelopes. I threw mine out, and wrote a complaint.

Companies routinely distribute software/presentations/etc. on USB drives. I suppose it's poor security hygiene these days but it's still routine.

Especially when stupid is an observable attribute in the industry.

Time and time again the technology industry has failed to consider security as a serious issue, never mind develop systems that are robust and transparent.

We don't have botnets, booby-trapped mail attachments, script-hackable servers, USB drives that can carry a viral payload, and all the rest because users are stupid, but because the industry's default culture is to think of security as an esoteric side issue, and not a non-negotiable critical feature in all IT systems.

More specifically, they tend to view it as a cost center that does nothing to increase profits.

Thing #1 to remember if you're in infosec is that you must pitch it based on the money saved by not having expensive problems like having to hire outside consultants and auditors after a breach.

I would guess that some people may try more than one, or if there are lots of people and few thumbs given time someone more gullible will try them.