I've been able to confirm this on one of my USB drives I used with my Yosemite Mac: the .store.db file contains a bunch of index keywords (probably from Spotlight) from files that have never been on the USB drive.
Included are things like webpage titles and URLs (from Safari history, indexed by Spotlight) and e-mail subjects.
Does this affect .dmg files too? Is this a "heartbleed installer edition"?