Most of the infections come from computers where security is poorly managed so the autorun feature isn't disabled.
Moreover, USB devices are inherently insecure as their firwmare can be rewritten for malicious intent.
From SRLabs BadUSB:
Reprogramming USB peripherals: To turn one device type into another,
USB controller chips in peripherals need to be reprogrammed. Very
widely spread USB controller chips, including those in thumb drives,
have no protection from such reprogramming.
(...) Once reprogrammed, benign devices can
turn malicious in many ways, including:
1) A device can emulate a keyboard and issue commands on behalf of the logged-in user, for example to exfiltrate files or install
malware. Such malware, in turn, can infect the controller chips of
other USB devices connected to the computer.
2) The device can also spoof a network card and change the computer’s DNS setting to redirect traffic.
3) A modified thumb drive or external hard disk can – when it detects that the computer is starting up – boot a small virus, which infects
the computer’s operating system prior to boot.
Defenses? No effective defenses from USB attacks are known. Malware
scanners cannot access the firmware running on USB devices. Behavioral
detection is difficult since behavior of an infected device may look
as though a user has simply plugged in a new device. Blocking or
allowing specific USB device classes and device IDs is possible,
however generic lists can easily be bypassed. Pre-boot attacks may be
prevented by use of a BIOS password and booting only to the hard
To make matters worse, cleanup after an incident is hard: Simply
reinstalling the operating system – the standard response to otherwise
ineradicable malware – does not address BadUSB infections at their
root. The USB thumb drive, from which the operating system is
reinstalled, may already be infected, as may the hardwired webcam or
other USB components inside the computer. A BadUSB device may even
have replaced the computer’s BIOS – again by emulating a keyboard and
unlocking a hidden file on the USB thumb drive.
Once infected, computers and their USB peripherals can never be