Viruses are malicious by design. An unnattended slipstream USB/DVD disk is not as it is intended to install a clean OS by design. This assumes the user wants to of course, the mistake was in the OP accidentally given it to his GF, as he has owned up to. The harm as you put it is a byproduct of the unnattended install, harm caused by viruses is by design.
Besides, there are much easier ways to wipe someones system than creating an unnattended slipstream install image on USB.
I think some people are trying to make this into a court proceeding. :awe:
This is my winner of the thread. What a frigging pissing match.
A) Unless it is a wireless controller for a device such as a mouse, it is never recommended to boot off of it. Non-IT folks don't know it, which is why they hire IT folks. I personally like the salary because not everyone can be an IT person.
B) The IT boyfriend let her borrow it, so she assumed it was safe. (and he confesses).
C) Anyone who remembers everything on their USB keys does not need USB keys. And the writing/labels rubs off. I carry 3 and use 5 and they are all physically different. I 'think' the white one has my 64bit Vista boot. and I think my resume is on the Tufin one. No promises.
D) Social Engineering 102 - want to own a company - put your malware package on a bunch of USB keys branded with the company name on them. Drop them outside the headquarters. They don't even need to boot on it. Ownership begins in 5... 4... 3...
E) There is no 'safe' boot order. You could protect yourself with a CD or PXE boot that scans before the HD starts... can be circumvented. The HD is assumed safe IF you have layers of defense, but most don't. So if breached, a really good rootkit gets in before the local layers of defense. But for generic sets, yes, it should be HDD. But when you get into the higher managed sets, it may not even boot of the System partition. If you don't have physical security, it never matters anyway. The moment you hand the computer to someone else, included the intended users, it is already at risk
I quit being to OS guy before USB keys became an option. Sure wish I had an USB boot installer. It sure would have saved a huge amount of time testing unattended installs. The CDs and later DVDs were SLOW and a bug fix required a new write to media. I am sure I toasted at least 500 discs starting from NT 4 to XP. And I walked to work, uphill, both ways, 40 miles, in the snow, on the interstate.
But freaking LIGHTEN UP. It is not a court room.

(well, it is ATOT - which is worse

)