For most part it's okay to pass through by I'd, unless it's some chinese device, which reminds me of the scene from Life Aquatic with Steve Zissou:
"- do interns get Glocks? - no, they all share one"
"- do interns get Glocks? - no, they all share one"
No amount of scripting with systemd path units, pre and post hooks, udev rules could make those work reliably (for me).
Solution, or workaround, after much headdesking: put services into a VM, map USB device by vendor:device ID, done.
If anyone could shed a light into why that is possible with a VM but not a LXC container, I’d be thankful!