Well it’s believed it entices users to click the malware to run by disguising itself as the last accessed folder with the same name and folder icon.

In that case having the option to always show extensions enabled would be helpful for trained users who care to be careful.

It’s not that interesting sounding given we know the NSA and eyes countries have developed compromised firmware for certain hard drives to enable true spread without interaction or hope of prevention. Whenever I see one of these I wonder if it’ll be a case of compromising the device itself but it’s this old stuff instead which can be defeated with a good security posture.