You could also enable parental controls so things are just blocked when you aren’t at your system.
there is your problem, by deactivating the sandbox but not raising the d+ level to proactive you left yourself open. The sandbox is what protects you from usb infections from what I have seen.