Well, you should assume that everything out there would be malicious, and work from _that_; if you go to DefCon specifically, this is a reasonable expectation.

New-ish Androids pop up a "USB connected, do you want to use this" prompt as well; but many devices (esp. embedded ones) don't.