If the phone is unlocked, a badUSB-type device can do anything a keyboard can do, so it’s far from completely harmless.