> ...keep in mind that a USB device can be both, or more...
Fine: let's assume the device can fake being both, or more (which it can), and that my machine will automount any USB mass storage device. (I actually think this is accurate.)
So it automounts the USB mass storage device somewhere… and then what? The machine is still locked, and I presume it would need to run something off that mass storage device to do any real harm, but how would it accomplish that?