Yep, there is always the human factor. Leave a USB drive in a parking lot, someone will insert it. You don't even need an obvious drive anymore, a malicious cable will suffice.