I imagine he means before the advent of 3d printing, services like PCBWay, products like Arduino, and online stores like DigiKey. It's probably much easier to make one's own devices today than it was when USB was first being designed.

He's also right about the physical access thing. Fundamentally, it doesn't make much sense to add protections against scenarios where the attacker apparently needs physical access, because there's no way to protect against all things he could possibly do then. It's not really obvious that the user needs protecting from himself as he plugs in a device of doubtful origins. We used to hold the user to higher standards.