Windows loads drivers FOR the device not FROM IT. The drivers loaded are based on the Hardware IDs provided by the device (VEN_ & DEV_). These are loaded from trusted locations (System32, or Windows Update), and have to be signed with a trusted certificate to be loaded at all for newer versions of Windows.
It is possible for the controller on the USB device to have malware on it. The firmware for it is going to be basically impossible to verify for the average user. The best you can realistically hope for is to be name brand flash memory from a reputable vendor, and reputable store, and trust that you are too small a target for custom firmware. Also whether or not the controller for the USB device can be reflashed with malicious firmware is going to be basically random, and difficult to find a device that can't be reflashed easily by a malicious actor.
The more likely scenario is that there are plausibly deniable backdoors written into the controllers firmware via sloppy coding. Those will be for random vendors from your point of view, and difficult to find. There likely aren't that many vendors that are affected, since it is very difficult to pull off, and therefore costly.
The autorun.inf vulnerability is largely mitigated with newer versions of windows asking you what you want to do with removable media when you first plug in the device.
Some Antivirus programs like Kaspersky also block USB keyboards, until they are confirmed under your control by forcing you to type in a string of text from the device. This only protects against fake keyboards though.
Most Hardware devices on the motherboard are DMA (can directly read, or write to memory, bypassing most safeguards), USB doesn't have Direct Memory Access, but there are plenty of other attack vectors, given that USB is designed to connect any type of device.
The .lnk vulnerability of Stuxnet attacked an explorer (graphical shell) bug for instance.
There is ALOT of attack surface on PC hardware, firmware, and software.
Here is a decent list of known attacks:
There will always be bugs in code that can be exploited, understand that, but also know that generally, for the average user malware infections will be from automated sources, and not targeted attacks, which greatly limits the likelihood of many exploits being used, since many of them are near impossible without being from a targeted attack.
The best you could realistically do is (in order of least to most effective):
1. Buy reputable hardware, from reputable sources, and never use the USB peripheral on computers you don't control.
2. Use a Virtual Machine to separate the peripheral from your Physical Host.
3. Use QubesOS, and only plug the USB peripheral in after the OS has finished loading.