If the device is plugged in when the user is already logged in, then of course the device can just pretend to be a keyboard, open a terminal, and run a compromising command. (shortcuts for terminals may vary, but are usually somewhat consistent). This can happen very quickly, too, so sometimes users may not notice.
But on servers, the story is slightly different. There's usually no GUI at all, and even the console session is rarely logged in, since most administration occurs over SSH. In the normal case no interactive user is logged in at all, just some services running under their own users. In such a case, what vectors could be exploited by a malicious USB device?