A computer is not just a processor, some RAM, and a hard drive. There are many processors inside a computer, including USB host processors, keyboard processors, clock processors, address bus processors, IDE/SATA processors, and more.
A "completely empty" USB stick could be reporting 0 files and folders in a single partition, even if it were, say, a keyboard programmed to advertise itself as a mass storage device.
There's a lot of trust that goes on at the hardware level for most processors. The firmware on many USB sticks are designed with the idea that they won't be programmed by end users. The firmware on many USB hosts also assume they won't be programmed by end users.
In other words, a user with sufficient technical skill could write their own code on to a USB stick, which in turn could write a payload to the USB host processor, which in turn could be used to subvert other systems through common buses.
This environment only exists in the first place because most processors include non-volatile RAM that they use as a ROM for storing their code. This allows vendors to build the hardware first, then drop the software in later. It's far more money efficient then building the software directly into the hardware.
So, with all that in mind, here's the answers you probably don't want to hear:
How can "empty" USB sticks contain malware?
Just because the OS sees something as empty doesn't mean it is. At minimum, it has firmware code running in a processor that starts up the millisecond the device has power. All USB devices have memory, even keyboards, mice, and sound cards. If it were really empty, the device wouldn't work.
However, if the device reports itself as a storage device, and the OS queries the partition table, the device can then simply send whatever data it wants, including appearing to be empty, or having an arbitrary storage capacity etc. Even today, you can find scammers that sell under-capacity storage devices that are re-programmed to report more capacity than they have. For example, you might buy a 32 GB stick that actually only has 2 GB of physical storage. The firmware lies to the OS, which eventually results in corrupt data when the user tries to use more than (for example) 2 GB of storage.
Is this only a problem for (legacy) Windows systems?
No. This is a problem for virtually every hardware device on the market. Some people estimate that this may be as high as 90% or more of devices, including laptops, tablets, phones, desktops, mp3 players, and anything else that has USB firmware in it. There's at least one manufacturer I've heard of that has "hardened" their firmware against reprogramming. A simple Google search will find storage devices that are resistant to reprogramming.
Is there some way to use these sticks while protecting yourself?
No. In fact, unless you examine every firmware's code before you plug it in to your computer, and, in fact, read your computer's firmware code before you plug anything into it, you can't be certain. It's entirely possible that your device was infected by the NSA before it was shipped to your store and sold to you. It might even be infected even if you bought all the hardware piecemeal and built it yourself. Unless you've physically created and programmed every aspect of your computer yourself, there's absolutely no way to be perfectly safe.
The best you can do is establish some level of trust, and avoid risky behavior. Avoid buying open hardware on e-bay, unless you reasonably trust the seller. Prefer buying brand-name computer parts instead of knockoff imitations, unless you can be reasonably sure they're safe (i.e. do research). Use as few devices as possible, and avoid sharing your devices with people you don't know. In other words, take the same precautions you'd take when trying to buy food, a car, or anything else. Most hardware is not currently infected, only because there's easier ways to get someone's data, but you should avoid casual exposure to risks.