If its running software (firmware and microcode being variants thereof) then there's possibilities for bugs, poor coding or just plain old overwriting .... all of which can be exploited by mischievous minds.
If Mr. Greenberg's assertions are correct, NONE of this is obvious. I cannot verify the whole chain in detail without considerable effort, but his case, as presented, makes sense. If it were easy to foresee this kind of problem, it wouldn't be a problem because many persons and enterprises would have acted to avoid or control the flaw. The relevant details for this prospective problem reside many dozen technical and conceptual levels below the window of ordinary user-knowledge and insight.
Your dismissive comment misses, misinterprets and trivializes the core problem identified and briefly described by Mr. Greenberg in the reference. Did you actually read it?
With fifty-odd years experience in computer architecture and design, going back a ways before the era of "microprocessors", I helped invent and patent the processes and methods of "microprogramming" which is a variant implementation methodology for the sub-instruction-level design of computing devices, deep inside the "cpu". The core architecture of a cpu, large or small, that uses "microprogramming" as an implementation method has the quality that the most basic machine-level "instructions" (op-codes) themselves are realized from a more basic specialized, superfast programmable engine wherein a sequence of "micro" instructions creates the component steps, behaviors, error recovery, etc for all possible states of each basic opcode instruction in the macro or micro-cpu by directly operating gates and states and latches and logical branches and "traps" that allow the process to occur precisely and efficiently.
Microprogramming, as described above, is very arcane and using it effectively requires a near-perfect knowledge and understanding of the exact electrical and logical sub-components of the core electronics, which may often change from one manufacturing batch to another. One way to decipher it, absent source data, is by painstaking observation and deciphering of the design by "peeling" a working chip and then observing electric fields (as insight to pulses and logic and architecture) on the chip surface during execution sequences with tools resembling electron- or AFM- microscopes. Doing this is normally beyond most hackers, and even most governments, but motivation can change outcomes.
More pernicious is the concept that most USB-interface products are built using chips from any of hundreds of manufacturers. Most of these have simple microprogrammable logic engines inside that are designed to provide design flexibility for implementing many products around a common core of functionality. Competing manufacturers often will use same or similar micro-engines, with proprietary code added, to implement both the USB function and other proprietary functions in the interface products they sell at dirt-cheap prices. Detailed engineering and microprogramming documentation is thus necessarily made available to hundreds or thousands of design and engineering people in a relatively uncontrolled manner. In many cases, it seems, the resulting end-user products are provided with means to access and modify their basic-device microprogramming over the USB interface -long after manufacturing - probably for updates, USB spec changes, etc, just by plugging device into a USB port with informed software controlling what follows.
..... And THAT means the core functioning of a very large portion of all USB devices potentially can be hacked to change their operational behavior
such that a SINGLE insertion of a thus-hacked USB memory or peripheral into a computer system can permanently transfer seeds for subsequent complete takeover of the computer system - and all the things that connect to it by secondary means such as installed programs and interactive meddling over the internet. In the darkest plausible scenarios, a viral spread of the style and scope of this hypothetical hacking process follows, logically and asynchronously, from the first insertion of a virally prolific hacked USB device into a single promiscuous USB port.