I believe that there is a misunderstanding on the rep's part about what "firmware" means. ixpand has encryption built-in, so there would need to be extra functions on the device to make that work.
But regardless of what things are called, you are worried about malware infecting the USB device itself, and not files, like BadUSB does. BadUSB does not require fully-functioning, extra-featured firmware. It goes after, let's call it a "widget" on the device that allows the USB to communicate with the computer. And yes, all USB drives have this "widget".
So, the "widget" can have vulnerabilities that can be targeted. Not all of them are vulnerable, and there are so many different types of "widgets" that it can be difficult to predict which devices might end up being vulnerable.
Your security expert is also not quite right, or the phrasing is strange. Some malware will write new infected files on the drive. And, yes, if it is designed to, it could seek out vulnerable "widgets" to infect. This is not a normal function for malware and it would have to be specially written for this use case, and the USB would have to be vulnerable. It's not an automatic fallback for malware.