Thoughts
To break down the threats:
1. impersonate a keyboard to sends keystrokes which install malware
2. overvolt/fry the USB controller
3. contain malware which the user has to run
4. AutoRun, baby
1 IMO is the biggest threat, but it has the downside that it's very simple—you only get one shot and you don't know what type of computer you're targeting.
2 is very possibly, you can buy devices that do this, but it's rare because there's no motive. It's not hacking, it's not malware, it's just destruction of property for the fun of it
I wish I could rule out 3. Unfortunately it happens.
=> https://web.archive.org/web/20060618060404/http://www.darkreading.com/boards/message.asp?msg_id=134658
4: Autorun was a feature that was removed from macs in the 90s and windows in 2009 after it was used for this sort of malware. It's no longer a concern.