In organizations where only HID USB devices are allowed, not mass storage? I'm not aware of any reported successes in that environment, although it's theoretically possible (Heck, you could even have your evil HID-presenting SOC USB stick open a command prompt and type in the malware if it detects a long enough lapse in input without an obvious screen lock command).

It is, but if your organization completely forbids any non-HID USB devices, users are less likely to try their found USB stick on a company PC, since they don't expect it to work anyway.