I assume the malicious HID keyboard can press through the UAC prompt on its own, just like the user's actual one can.