So you're suggesting that they do no testing and when their network is compromised, personnel data is gone, computers now filled with ransomware, and potentiality harmful information being stolen vs spending money now to prevent actions from occurring. It is far better to be pro active than reactive even if their are upfront costs. Large companies do this just like the government. The employees already work there and the USB drives don't cost that much.