The thing is, adding an inline fuse doesn't guarantee that the host would be safe: if the fuse doesn't blow quick enough and lets enough current through, that's bad (plus, you'd have to add a fuse to P-, D+, D- and P+ just to be sure, not to mention USB3). The best option would probably be a complete isolation of the USB device from the host, with a hub that then transfers D- and D+ to the host without a direct electrical connection (while providing its own P- and P+). Think TOSlink, but for USB.