Even that may not work. See Stuxnet.[1]

[1] https://en.wikipedia.org/wiki/Stuxnet

Yep, there is always the human factor. Leave a USB drive in a parking lot, someone will insert it. You don't even need an obvious drive anymore, a malicious cable will suffice.