That $4 USB drive from the gas station took down my whole client network last month
I plugged one in to move some floor plans at a remodel site in Tulsa and it popped a ransom screen within 20 seconds, so why do people still think free drives from random places are fine when a basic scan would have caught it before I ever touched a computer?
Plugging into a machine that's already booted is the problem, since autorun and the OS will just hand it over before you get a chance to scan. Grab a cheap Linux live USB and boot into that first, then check the drive in a sandbox before it ever touches Windows. Better yet, only pop in drives you own and image them from a write-blocked port if you have to.