TL;DR: Is possible but not probable. Your keyboard is way more trusted than your cellphone.
Is it possible that a USB keyboard could host a keylogger and that Windows could give it control to run a process to send the information to an address?
Yes. If you press keys to start programs, and type things on the program, that's the keyboard running and controlling a process. It's so simple that we don't think about it.
Running on the hardware, there's nothing on Windows indicating anything: no delays, no extra traffic on the USB cable, no strange control messages anywhere, no custom drivers. Windows will never see anything different about it.
The problem is the exfiltration. The keyboard can type back everything that he captured, but it have no visibility of the computer. The keyboard only can talk to it. It can send keystrokes and hope that they will get out.
It's possible, for example, to send
Win+R, type an URL for something that will capture everything server-side, wait a little, and type the log. If there were enough time to the browser to load the page, and it is still in focus, the exfiltration is possible.
As the keyboard can know with some extent how long you are not using the computer, it can wait for 3 to 5 minutes after the last keypress to start the payload. The keyboard knows if you locked the screen with
Ctrl-Alt-L. Unless you are only navigating with the mouse or watching a video, this means you are away. 5 minutes is short enough to not engage the screen lock, and long enough that most people won't stare at the screen for that long.
But what's the probability of this happening? Very, very low. This is not an easily targeted attack. It's way easier to phish you into installing software than to count on you visiting his site to buy his altered keyboard.
Pentesters usually resort to this, when they have physical access to the computer: pop open the keyboard, install the keylogger and leave. Get back the other night, pop open the keyboard, get the log and leave.