Message from a programmer from EOS: to clarify:
The firmware is compromised on USB devices
This could be any commericial USB (including the ones they are shipping) not just Freos. The manafacturers often have holes in their proprietary firmware or worse. Any USB you buy is at risk unless the firmware is open source and audited. All SD storage has a micro-controller used to handle errors in the memory. That gives them the ability to hid files, emulate the keyboard, mouse, network card or other things a USB can do.