They can't, he probably installed whatever software that came with the hardware.
There is a few mechanisms through which hardware can get the OS to execute code, so it is possible for the BIOS to cause software to be installed. E.g. the easiest one is probably the "Windows Platform Binary Table" in ACPI.
I guess you're right. I don't understand why my previous comment is being downvoted though.
[dead]
Now my biggest guess is that xhost + is being used to allow a process running as root to launch a window into the existing xserver no matter what (probably a graphical client).
It's a very bad practice though. How comes that devices can autorun software nowadays?