Android is kind of the same: by default, no data connection is made unless you explicitly change the USB mode from charging to something else.
You're correct that if I plug the phone into my PC the phone defaults to just charging from it, and needs an explicit UI intervention to offer other features - but if I plug it into my USB keyboard it just works as a keyboard, no further UI intervention needed.
I guess it's _possible_ that I forgot having one time authorised this for the keyboard, but even if that's true it means a malevolent device just needs to guess what to impersonate to get into any phone that has even once authorised such a device, because there's no cryptographic protection - if I say "I'm a Cheap Ass Generic USB Keyboard serial # 00001" then there's no way to distinguish me from the real "Cheap Ass Generic USB Keyboard serial # 00001".
Now, maybe the situation is that phones allow some safer things and not more dangerous ones. Maybe you can pretend to be a USB keyboard or mouse, but it will refuse to offer any of the file transfer type features or networking. I don't know, but my expectation is that people who've built these cables do know and there are plenty of holes.
But anyway, suppose phones are smart enough to refuse to charge from a keyboard. These cable are remote controlled. So you plug in your phone, it charges... and then a minute later when you're distracted it gets told the charger went away... and now here's a keyboard. Attack in progress.
I reckon you could work out a procedure e.g. pretend to be power for 90 seconds, supposing experience teaches that's how long people take to forget they plugged the phone in. Then, turn the power off. Watch. An attentive user may notice, unplug their phone and try again thinking the cable may be faulty. Re-enable power when the phone vanishes. If not, after giving them say 30 seconds to notice switch to keyboard mode. Or you could just wing it. A lot of good physical penetration testers "wing it" all the time.