It’s as if nothing was learned from AutoRun CDs and the like.

On the contrary, they learned to make malware authors pay them first before getting access.