I disagree. When you attach a USB drive on Qubes, it’s connected to a virtual machine and isolated from the rest of the system. This protects you from many USB attacks. In a typical case (when sys-usb is a disposable VM), a reboot of sys-usb will reset it and your sys-usb will be secure again. In the worst case, your sys-usb controller may become compromised and might compromise everything you connect to it later. See also: Should we have one "sys-usb" per USB Controller? and Proposed procedure for using untrusted USB drives.
2 Likes