I mentioned in the other reply to T3OU-736 that the real issue is how wide the spectrum of attacks are. There are things that are on the userspace level (assuming you'll run a file with malware hidden in it), to the hardware level (device emulation to pretend like it's a keyboard or ethernet adapter) and even down to the firmware/USB specification level (device firmware upgrade attacks or the USB Kill stick). That's why generally the best advice is to never trust a USB device that isn't yours, otherwise you're going to get involved in layers upon layers of mitigations, and often the more layers of mitigation layers you add can actually end up increasing your attack surface if you don't properly maintain them or fully understand them.
You could have a kind of air-gapped system that is running a non-persistent OS like Tails, plug in USB keys into that to check them for basic things, but again, the risk/reward tradeoff seems quite heavily leaning towards risk.
Evil maid could definitely do that, but that comes to your threat model. If evil maids are in your threat model, then you should never leave your computer (let alone your USB devices) unattended. Regardless of the USB devices, evil maid would probably just go in for your computer or power supply first. Most threat models that involve evil maid attacks would also mitigate those by having fully separated sets of hardware just for travel that are always treated as being potentially compromised.
For the drive-by plugin, that's a very real threat to some orgs, which is why a lot of orgs with sensitive data will just shut off USB ports in the system BIOS, so that nothing can ever be plugged in anyways, or they use some more sneaker-net tactics and put tape or other coverings on exposed USB ports.
You could have an OS level intervention, but again, a lot of attacks are closer to the metal than the OS, which is why it's such a mess :(
Best strategy is still only use your own devices that you own. I don't even really accept USB devices from others. If they need to send me some files, I get them to use Dropbox or similar.
QubesOS does have an interesting way of handling USB device management and protection locally, but getting into using Qubes can be quite tricky for normal people, so it might actually just create a larger attack surface if you use it incorrectly.