Asking you if you trust a device before opening a data connection to it is simply not the same thing as asking the person who just created a shortcut if they should be allowed to do that.

How do you know the person created the shortcut and not some malware trying to get a user to click on an executable and elevate permissions?