back in the day when socket cpu were popular some carrier board manufacturers said the same thing, that without cpu their product was not covered by testing regulations. fine, said fcc, but if anything adverse does happen you are 100% responsible. this led to many of the board manufacturers to have their products tested with intended cpu installed. so, fine, sell the modules without testing the intended use, i.e. with omega2 installed. but if it gets to market and that little power regulator causes fires, then guess who is on hook? same should be with unprotected usb causing microprocessor damage. particularly since the protection was in the schematics. that is way i see it. does that mean any particular liability exists. that is for regulators and lawyers to decide.
But I got worried about the voltage mismatch, thinking that the USB slave device might send back the full 5v. (Some things I read talked about 5V is actually more than intended, so that the voltage drop from the wire length could be absorbed.
Only if it is improperly implemented or you allow the signal lines to connect before the ground, something USB connectors are physically designed to avoid, but that could conceivably happen with other custom wiring schemes.
USB uses 5v power, but the signalling is 3.3v, or lower.