Autorun used to be enabled by default in Windows XP, and would execute any file referenced by
autorun.inf when a storage drive is plugged in. It used to be really easy to execute malware from an USB drive, just reference it in the autorun file and let Windows do the rest.
It was disabled in Windows Vista and later for obvious reasons, and yet this software reimplements its functionality, most likely as a cheap workaround so they don't have to print an information leaflet telling users to run the software manually.
Checking USB IDs is not sufficient as a rogue device can enumerate as any device, including the original modem's, and yet present a rogue file. Checking for a signature is risky as well, as you don't know how well the associated private key is protected (I wouldn't entrust anyone thinking this software is a good idea with a private key). There may also be vulnerabilities in the code that checks the device itself.
Finally we don't know how this is implemented. If this run as a service under the system user, then this would not only run potentially untrusted code from USBs but also run it as SYSTEM. Worse, this could be implemented as a device driver which means malicious code could be run with even higher privileges.
This device is a bad idea altogether - throw it in the bin and get a mobile<->Wi-FI bridge, those don't require any shady drivers and appear just like any untrusted host on the network, something you can defend against with a firewall.