Honestly, if the victim thinks it's legitimate and they've plugged it in, autoplay being disabled is no big deal to the attacker, chances are, they're going to double-click the setup.exe/install.exe anyway...