I remember a security presentation on USB saying the same thing. It's a network, not a bus, and anything on a network can be malicious