If your USB ports are disabled for data how do you plug in a mouse and keyboard?
They can even block all but allow-list certain vendors and models, but because USB is an unauthenticated standard - an attacker can easily spoof any vendor or model. So best not to rely on that and instead block all of certain types of USB device.
No ones going to disable mice/keyboards.
If the point was to eliminate all possible ways of compromising the device, they'd just put the device in the shredder.
You have to balance having a usable and functional thing with the risks involved.