A USB that was both storage and a keyboard, that executed the keystrokes to download malware, was demo'd at a DefCon a few years back.
[0] https://shop.hak5.org/products/omg-cable [1] https://darknetdiaries.com/episode/161/
That's almost 12 years now. A novice can now get ATmega32 USB devices Prime delivered. Not a cutting edge theoretical attack anymore but a basic tool in a every pen tester's toolbox now.