I don't mean that the attack isn't possible/wouldn't necessarily work. I'm saying it's impractical given that one of the steps to execute it is "have physical access to the machine, the ability to install software, and time to sit around and record the outbound data (or to be able to revisit the site and collect a recording device)."

With each of those requirements, there are easier and faster ways to get data off a machine. If you can install software you can likely download data that software would access. If you can access the machine twice and install software that runs in the background between visits, you can install your keylogger/data collectors and simply record the data on the device.

Stuxnet wasn't about getting data out of the machine, it was about breaking machines. It worked well because it didn't require physical access to the machines. It spread as a virus through the regular updates that Iran was doing for their machines.

If you had such a stuxnet virus in your back pocket, then you can likely steal the data and record it back on the USB device (or any plugged in USB device) on the system.