One reason is that it's surprisingly hard to find a cheap flash drives that use hardware enforced read-only access.
Yeah... BIOSes are attack vectors too.
Of course, this assumes the firmware is secured too; aka Bad USB.
An OS read from a CD player that's read-only won't have this issue; that said, even if the CD is burned and all the free space too, it's likely you could introduce an exploit onto the CD by editing the encoding already on the CD by putting it in a CD player that's able to read & write to it and override the read-only flag on the CD.