I submit the ISO stick as a candidate for consideration. It is in a USB factor, and you plug an SD card into it for storage. From the computer side it is just a flash drive. This is done so even if the device stops working or gets crushed you can get the SD card out and save your otherwise doomed data.
The firmware is flashable, but only through the use of a physical button. The button is at the bottom of a hole which is only big enough for the tip of a paper clip. It is impossible to accidentally push. Additional, I believe the timeout is short like 5 minutes, after you push the button to flash the firmware or it becomes unreachable again. During the 5 minute interval an additional port is visible which allows the firmware to be flashed.
In addition, it has a second read-only switch to make the USB storage if you choose to use it. Read-only ON plug it into a machine with a virus, and the virus can't touch it.