Comment by microtonal

But today a whole lot of mechanism is spun up when the kernel realises something new was added. A netlink socket talks to a udev daemon, in userspace and that daemon, being ordinary userspace software can do whatever it wants including of course run a bunch of arbitrary shell scripts, which can in turn do whatever they want. So yes of course they could download arbitrary software, or delete all your files with a Z in their name.

I know how udev works (old enough to have used Linux without hotplugging and the old hotplug scripts pre-udev).

You still haven't told me which distribution has a mechanism for udev that downloads arbitrary executable code from a vendor. It's a programmable system, so of course it is possible to implement this. My point is, I don't think any mainstream distribution does this.