> it's your responsibility to vet what you plug into it

Okay, please explain a little more. I'll give you a concrete example of a device to work with.

Last week I accidentally left my usb flash drive at a coffee shop with some important files on it. When I went back, the coffee shop had it in the lost and found. It looks the same on the outside, but it's a mass-produced model.

How do a vet this hardware before plugging it into my computer? I do need to access the files on it, but also attackers may have had access to it for several hours.

If security is so important to you, you buy a $100 laptop, put the stick in it, get the files and upload them somewhere then burn the laptop and stick.

Or just go to an "Internet Cafe" and do it there.

A human cannot vet an electronic device. We can only interface to it from another electronic device.

The same argument applies to the Internet -- we don't say that it's the human's responsibility to vet every website or email message before we let our computer connect to it. We expect our computer to do that. That's why it was wrong for Outlook to automatically execute every program sent to you via email.

Your computer isn't vetting things it gets from the internet at all, with the exception of TLS certs and anti-virus scanning. Virtually all other operations done with remote content are unvetted; it's play & pray. You clicking a button is the only vetting process.