> What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device.

QubesOS does this by quarantining your USB controllers in a dedicated virtual machine.

https://www.qubes-os.org/doc/usb-qubes/

Usb-guard for Linux also uses kernel features to accomplish similar.

I dont know of any methods to do this on MacOS or Windows though.