It can act like keyboard an mouse that are valid input devices on phones too. With control of user input badusb device can download and install malware on the phone.

Now we're just taking in circles. What exactly can a malicious USB device do to a phone? On Windows it can press Win+R, but there's no equivalent on mobile.

Which keystrokes are you talking about and on which OS does that attack work? I can't think of anything that would work on my iPhone.

Open chrome (swipe up with virtual mouse, type chrome, click first entry), focus on address bar, input url of malicious apk, download it, open, confirm installation from unknown source.