Has there been any kind of attack actually detected that goes through this vector? This has been infosec lore for as long as USB charging and smart phones have been a thing but I've never really heard of it actually being used.
There is indeed a cheap product that does exactly this: https://o.mg.lol/
I mean as an actual attack not a product that could execute a similar attack. IE an instance where a public charger has been detected or caught attempting to infect phones.