A slightly cleverer device could get even better. If it only enumerated as the "evil" device (whatever it is) after several minutes or even hours after some amount of activity followed by inactivity, then it would be quite likely the user isn't at their PC to notice any messages from their operating system, suspicious behaviour, or other warning signs. Someone attempting to scan hundreds of mice for malicious ones would have an even worse time: Because it waits until the user appears to be using the mouse, simply plugging them into a test computer won't immediately reveal the evil. This can be taken further, including fingerprinting the host operating system, time of day, or any other number of factors.

Even that's not guaranteed. You could just have the mouse wait 1 hr before doing nasty-keyboard-mode. Or only go into nasty-keyboard-mode after certain amount of button presses etc. It's an arms race.