For example, if my phone is compromised, can it execute code on my desktop computer just by plugging it in USB? Or vice versa. I ask because banks' and other services' 2-factor authentication commonly depends on sending a text message to the user's phone. If this is a risk, follow up questions: is it a theoretical or practical risk? What's the suggested way for moving data between devices?
Edit: To add a concrete example, let's say I have a Windows 10 desktop pc and an Android phone. My pc is infected with a banking trojan which wants to transfer money out of my bank. In order to do that, it needs access to my phone, because my bank sends the 2-factor authentication code as a text message. Once I plug the phone into the computer (to transfer photos or something) the trojan now infects the phone. The next time I log into my bank, the trojan on my pc can make a transfer out of my bank account while showing me an innocuous page. When the 2-factor auth code is sent to my phone, the trojan in my phone will hide the message from me and send it over the internet to the trojan on my pc, to finalize the transfer.