The key thing to realize is that malicious USB devices get to choose which device they identify themself as to the operating system, but have much less control over what they physically look like to the user.

If you plug in an old printer, you know you just plugged in an old printer; you can load the old-printer device driver and it probably won't exploit it. But if you plug in a USB stick you found in the parking lot, and it asks you whether you just plugged in an old printer, then the game is up; you know it's a tricky device, pretending to be something it's not in order to target a security vulnerability.

You are putting way, way too much faith in the average user. See, for instance, TLS exceptions. Also, realize that all the adversary needs to do is some trivial social engineering. A label on the thumb drive with a picture of the prompt and a mouse over "ok" would probably do it.

And because the 99% use case is: "I plug it in and I want it to just work"

This type of protection parent is referencing is "endpoint protection" and there are many industry standard solutions. Why should an OS be more limiting? If you have physical access to a machine that stores things you shouldn't have access to, it's already compromised in my opinion. Why the eff are people overlooking physical security in 2019 is the better question.