but even that reduces the attack surface from "literally anyone could stick this in their PC and read the data" to "basic amount of technical literacy and curiosity required"

The alternative is a password and encryption which could be just as bad but is also connected to the public internet.

On a usb drive, the range of possible attackers is comparatively miniscule.