> What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device. This should apply to its capabilities too (eg: if a "keyboard" suddenly is presenting itself as storage, that causes a prompt). Think along the lines of "Acme WebCam XYZ wants to add a Camera and Microphone. Allow?"

There's USBGuard on Linux that seems to do some of this. Can't vouch for it, as I've never used it, though.

https://wiki.archlinux.org/title/USBGuard

https://github.com/USBGuard/usbguard