Worth repeating: they can read ANY page in RAM. Including those which contain user key hashes, session hashes and any password which happens to be stored in clear in memory.
While OS can protect process' memory from all other processes, the DMA is one level closer to the metal. No matter what OS you're running, plugging random devices to your system means the game is over.
(1) HW virtualization mitigates some of these risks: I'm not familiar with the details of it. But since most of the machines are running without the HW virtualization still, they are still vulnerable.
edited for formatting
There are vectors beyond "autorun" for attacking machines with USB devices (for instance, automatically mounting filesystems exposes the filesystem to malicious block inputs) but these are squarely in the OS's bailiwick.
It's also much harder to reliably launch an attack from, but in the case of a targeted attack where the OS is known it wouldn't be too difficult to come up with something that could sneak some nasties in with a low chance of detection.
I don't know the answer because I don't use Linux for day-to-day work (I work in gamedev, whose primary platform is Windows) and I'm too poor too afford a Macbook.
Do we think there are no vulnerabilities in the USB code, the drivers for any particular USB device, filesystems, or any other pieces of code a USB device can invoke? I am very doubtful.