We mailed customers USB drives that when plugged in would mount and start tinycore Linux, then write the new system to a parallel partition, reboot the machine, then run a few health checks.
Some might say it's hacky (it is/was) but it worked pretty well and allowed for recovery of totally borked systems.
This would be a non starter for any security conscious client.
I have no idea if they did that, but mailing USB keys should be fine with the right encryption or validation
Just a bad idea all around. There should not even be USB ports IMO.
I read it as that Integrity and Confidentiality was the only factors here, so USBKill-style stuff (Availability) would just mean the machine was replaced, Integrity should handled by the boot process and Confidentiality should be handled by the embedded OS itself.
Several of these companies also had strict email attachment filters that we were instructed to get around by just appending `.allow` to the filenames. There was tons of this type of stuff that we encounted which really highlighted that corporate security at many companies is just theatre.