If you plug in a usb stick and it pretends to be a keyboard/mouse, it can do anything it wants to your system [within the context of a keyboard and mouse] as soon as it's plugged in. Hardened drivers do not prevent this. Granted, this is less dangerous if a machine is locked, but you can leave it plugged in and wait for someone to log on.

It does point out the most glaring flaw in the lack of a security model, though: you should be able to approve or deny a new peripheral connection before the drivers are loaded or DMA is allowed.