I think it's even easier than that; we now have cables that are normal shape and size of a USB connector that have an embedded system in them with a webserver, keyboard emulation, mass storage and wifi for a remote attacker to connect to.

It's also easier to just ask to quickly use the worker's computer to get a presentation going.

"Oh yeah sorry, my presentation is made in PowerShell instead of PowerPoint".