Even better scenario: (but I'm not sure if possible) Malware is downloaded from the net. It hijacks one of the usb HIDs. It than removes itself from the system and once every few hours sends something like lsusb | grep "ID: hackable" > /dev/emulated/and/spoofed/sound/card when the data is received by the spoofed sound card, hacked HID turns on network emulation. It then sends commands to change routing so it could download needed, hacked firmware to a local disk. It infects the newly inserted, hackable device, and goes back to sleep.

Possible? I hope not.