A USB device with "manipulated firmware" can sure do evil things. For an extreme case, see this answer: the USB device may tell to the OS "hey, I am the FireWire-to-USB converter X.Y, please download my driver from your vendor, then grant me full DMA access when I say so". Though theoretical yet, this is not science-fiction, and it sure is scary.
For more mundane setups, including some which actually occurred, see this answer.
Even if the USB device is "just" a USB drive with an honest firmware and an empty filesystem, it still has a boot sector (first sector, the one containing the partition table) which is code; but that one will be activated only if the user tries to boot his machine over USB (this worked wonders in the floppy disk era, because most machines would try booting off the floppy if present; nowadays, if almost all PC can boot off an USB drive, most will not try by default).