If the USB device is not permitted to enumerate when the device is locked, then the payload just fires when enumeration happens after unlock.

You either ban USB devices entirely or you make users approve on every connection with no white listing.