Do you see the 5 lines at the end, all containing GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX"? I am pretty sure they are from your 5 attempts at running the salt recipe and failing somehow. In any case, you can remove all 5 of them as they are not doing anything and replace them with this one line:
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX rd.qubes.hide_all_usb"
Mine shows as a qube too and you are not the first to find this confusing. It’s a thing only the menu does. Neither the Qube Manager GUI nor the qvm-ls command line will make such a distinction. @ninavizz maybe this is confusing more then it helps?
The basis of whether a qube is shown as a ‘service’ or not is whether its provides_network property is true or false. In other words: what we commonly call ‘proxy qubes’ (qubes that can be selected as ‘netvm’ for another qube) are shown as ‘service’ in the menu.
Unless you want your sys-usb to provide network to other qubes (e.g. USB-based tethering of a phone hotspot) or you just “need” it to say ‘service’ in the menu, it makes little sense for sys-usb to provide network.