After some thinking I'd guess that there are actually two bugs: 1) That virt-manager automatically redirects without asking (because apparently it now has a menu (Virtual Machine/Redirect USB Device) which should do just that. Actually IMHO it should generally happen only manually, because it's quite annoying if everytime I put in some USB device, all my virt-manager consoles would ask for it.
2) A security hole in the polkit configuration, in that it allows any user actually redirect - and via that - gain full access to such USB device. So only if root has manually (via configuration) allowed a user to redirect all or specific USB devices polkit should even grant the whole thing. But even then, it shouldn't happen automatically, but only when the user really says "oh, yeah,... go and redirect". Cheers, Chris.
smime.p7s
Description: S/MIME cryptographic signature