Yeah, I heard. Still the case of a badly configured device.

Remember kids, it's a software driver configuration. Show me that BadUSB that works on the dumb DOS operating system. No? Yeah, didn't think so. Only "clever" OS'es are pwned by this, and if you dumb them down then nothing gets to run automatically.

BadUSB or similar could be setup to work on DOS if the system firmware does USB keyboard mapping. You can do copy con foo.exe or something with debug, and then stream the executable you want to run, then run it. A bit more work, and there's no standard networking and all that, but it's doable if you really want it done; but you'd need a target to make it worthwhile.

Sooo... we go back to my initial point of a "badly configured system"?

Well, most of my recent computers don't have an option for keyboards that's not USB. But a system with no inputs is probably the most secure you can get.

You can also hotglue unused ports and physically prevent unplugging the intended devices. But that's not realistic for most systems.

It's the old usability vs security compromise.

Any DOS is susceptible to Bad USB emulating a keyboard if the BIOS supports USB keyboards.

Autorun/autoplay are only one possible vector for attack. No matter how well configured your device is it can still be destroyed by an electrical attack where a bad USB device charges capacitors and then zaps your device. Got it boomer?

Or USB Killer... Although there's generally no financial incentive for an attacker to mail you a USB Killer.

Like with most DoS style attacks it's mainly vandalism. Though an online DoS could be used for market manipulation at the right time, it usually isn't.