Don't get distracted, if they are exploiting an USB vulnerability the "don't allow" feature by default will do nothing.