> I suspect you're arguing from the point of view of a determined attacker against a specific target

Not necessarily a specific target(although maybe in a sense). If I were, say, the Chinese intelligence apparatus, I'd be sprinkling exfiltration devices around D.C., military bases, and defense contractor offices(especially the small ones, who don't always seem to have their shit together).

You can fit a lot of smarts in a small form factor these days. I could, with the budget of an intelligence agency, cheaply mass produce USB storage controllers which only activate when specific files of interest(say, OrCAD schematics, or source code) are saved to the device. I could sprinkle them around, or even just strongarm one of my country's manufacturers so that the bug goes into wide distribution. Now I use sniffer vans, like were used to execute the Tempest attacks against military bases in the 80s, to find my beacons and exfiltrate.

GSM modems might be expensive, although it would be a great way to get data out. You could also add GPS and use a small geofencing database to activate when you're within a target radius.

Keep in mind this is just the musings of a bored idiot(me). I suspect an intelligence agency could find more useful things to do with a USB stick.