Don't get your panties in a bunch. Right now this is just another possible attack vector. If the devs at Sony did their homework then the themes (and the associated scripts) are kept in a sandbox which is locked down tight.
So ... isoloader? Probably not.
Interesting stuff for devs to play around with? Maybe.
Hate to be a party pooper.. but literally not a byte of shellcode, it won't work without USB because loadme.FU is a resource in the XML, in this case an animated icon, and it also contains no shellcode. Feel free to look at it under any hexeditor.