Since USB device ID's cannot be trusted by themselves couldn't some 2FA (eg USB security key) be used to authorize a device for as long as it stays connected?

Once a USB security key has been authorized and is kept on your person rather than constantly attached to your machine it should be impossible to connect a new device and have it trusted by default - and re-connecting an already connected device would de-authorize it.