USB Flash Disks visible to ALL from XenApp!

Wyse c50LE terminals, Windows 2008 R2 terminal servers running Xenapp 6.0
When we run the latest TCX (eval) we can mount flash disks from the c50 units but all users on the terminal server see the disk and can write to it!

I am quite sure this has to be some oversight on our side but I see nothing in the documentation to suggest we can set security on XenApp/TS. This makes sense for VDI but not at all (obviously) on XenApp/TS.