Are internal components vulnerable to BadUSB? Say you have a laptop. Even if you don't use any USB devices (like mice and keyboard), if the laptop has internal components that connect through USB (like a webcam and fingerprint reader) could these have their firmware modified in order to persistently infect a machine?
BadUSB is no problem for internal devices. It is more the other way around, you should not connect external USB Devices to your computer.
BadUSB works in the way that you think a ordinary i-phone charging cable or a USB stick or most likely a manipulated smart phone to your computer. But in realty the device acts as keyboard, mouse and or network card,and therefore is able to change or exfiltrate or monitor data on your device.
I don't think someone will use BadUSB against you,but if you think you need protection one solution would to make it impossible to connect any external USB devices to you laptop.
There are software solutions which make it hard to use BadUSB. But they are not easy to implement or use and you need to know what you are doing to make them work.
Yes. If an internal device has updateable firmware and that update mechanism is unauthenticated (or a compromised authenticated update procedure), in theory, it could be updated to contain malware which infects the host machine. An additional prerequisite would be the firmware storage on the device would need to be large enough for useful malware (and original firmware if it desires to go unnoticed).
But it's probably not done in practice as "commercial" malware depends on infecting as many machines as possible and infecting the compromised update procedure of internal USB devices (most likely of a specific vulnerable model of laptop) sounds pretty niche. But a solid Master's thesis.
If one's threat model included this threat, screwdrivers and scissors are likely all that's required to mitigate the risk for unnecessary, update-able internal USB devices.