It's in the interest of journalists and newspapers to have some kind of sandboxed machine, but I'd doubt any smart whistleblower would want to physically deliver a USB either in-person or via the mail. If said whistleblower is technically competent and thorough, then a multi-layed digital drop makes much more sense these days. Fewer points of failure and all of them are in your control as long as you can configure it yourself rather than using off-the-shelf means like Signal*

(* Not to say Signal isn't good for everyday use, but I wouldn't even want whistleblower-level info on my phone in the first place.)

/rant

That would make entirely too much sense which is why I would never assume they are actually doing that.