In a isolated VM? No way. Most people don’t know what a VM is. Hopefully most people wouldn’t plug a random USB into their computer, but I suspect that (# of people who would plug in a random USB) > (# of people who know about VMs)
Even among the people who "know about VMs" how many of them could confidently plug in a physical device to a physical machine and be sure that it was somehow isolated to the VM? I must have a dozen ways to run VMs here, but I couldn't do that.
What is the most common attack vector to fear? I thought maybe auto-run had been disabled by default, in most modern versions of Windows, for the past 10-15 years at least.
If you plug a USB keyboard, windows will automatically set it up. All the stick needs to do is emulate a keyboard, then it can send keystroke to the OS as yourself, no need for auto-run.