You've got to be kidding. There's no way I'm going to plug someone else's thumb drive into my computer. Who knows what kind of malware it could be carrying, like having unprotected sex with a random stranger.

The USB drive I keep on my keychain is named STUXNET, so...

Is it any different when you receive a zip file by email? It could very well have been crafted to exploit a backdoor in your compression program.

It is different.

A USB key can be anything, or even complex combinations of things. It can be a storage device and an HID keyboard input and an optical drive that autoruns software on the PC it is connected to, with all of this being intentionally supported by the host operating system.

No back door is required: This can happen right at the front door, as the operating system does what it is intended to do when it detects new hardware.

And as a parting shot: It can even deliberately physically destroy the host computer's hardware. (Try that with a crafty ZIP file.)

It's easier to exploit somebody's computer using a USB drive, because it can do things like pretend to be a keyboard and spoof your inputs, and because the attack surface is "every USB driver", but we have to assume a skilled attacker can do just as much damage with a DVD+R. AFAIK, no kernel filesystem driver is designed to be robust against maliciously crafted filesystems, and FUSE is not designed to be a security boundary. If you're taking security seriously you have to take the same precautions with each, e.g. disabling automount, and only mounting them in a disposable VM and accessing the files over the network.

And even this might not be enough. Is your OS's partition table code robust against malicious input? I don't think there's any way to disable reading the partition table in Linux when a new block device is detected. In this case even copying a single file to/from the raw device with dd might not be secure.