Yes, there are corner cases (another commenter mentioned a temperature sensor, and I this is also common among barcode scanners). These corner cases are not hard to work out; just prompt the user and require them to confirm that the device is, in fact, allowed to act like a keyboard.

(Which would mean you can still have malware-download-command-typers pretending to be barcode-scanners pretending to be keyboards, but you can't have malware-download-command-typers pretending to be storage devices pretending to be keyboards, because the "Allow typing with this keyboard?" dialog will give it away.)

I would guess that 99% of users would click ok for "Allow typing with this keyboard?" when they plug in a USB storage device.

I'd hope the Secret Service is in the 1%.

You would only need the password-auth to bootstrap your primary keyboard. If you already have a keyboard you can just accept the prompt.