A USB flash drive with viruses on will probably be pretty ineffective; someone would need to run the virus manually without AV picking it up which is pretty unheard of. Plus, any organisation worth it’s salt will have a policy that automatically blocks drives that aren’t encrypted with a company-issued encryption key.

The real risk is that a device like this can emulate any USB device, including disks, keyboards, monitors, serial devices, etc. So you plug in the key and in a split second it opens a terminal and types a dozen especially tasty commands…