> The asset has the ability to plug in a personal thumbdrive to the network.

Sounds like it just patches a local copy of VLC by running an installer. I don't know if I would consider that compromised.