You can either have a port where you can run trusted devices without hassle, or one where you can input untrusted data safely. You can't have the same port do both.
That's an inherent problem with universal ports that do a bit of everything as opposed to having distinct storage-oriented media. I don't know how you'd tamper with a diskette to brick a computer.