I'm inspecting a USB battery pack w/ included USB fan, and noticed an interesting quirk in its design. The battery pack regularly outputs an expected 5V at 1A for most USB devices, however with the included fan, it enables a boost up to 10v to get a three speed fan configuration at 5v/7v/10v. Since the product is too cheap to have a slave controller for USB in the fan, I assumed it was using some kind of passive signaling to enable the battery pack to output 10v. Further inspection reveals that the battery pack enables a 10v 1A output if the connected device has both data pins tied directly to Vcc (as it does on the included USB fan).
I'm curious if this design of convenience poses a safety risk / flaw. Since 10v out of USB isn't standard without power delivery, what prevents any consumer device that happens to internally tie D+/D- to Vcc from being fried with 10v by this battery pack? Does it simply rely on hoping that most power-only consumer devices will either leave D+/D- floating or tie them to ground?