Yes there are two pieces of uber-secret space alien technology Microsoft included in Windows at the behest of the NSA called "autorun" and "plug and play".

Windows installs a Plug and Play device and its driver automatically. http://www.microsoft.com/resources/documentation/windows/xp/...

Well, there's a piece of Apple-championed technology, Firewire, which doesn't care what OS you're running because it has direct path to the DMA controller, and can read and write physical memory.

Yeah, that applies to PCMCIA and Cardbus too.

A USB attack device could probably also emulate a hardware CD-ROM.

I wonder if they could emulate a crypto accelerator and actually use stock drivers with backdoored hardware?

This is not true. OSX locks down the FireWire ports to protect system memory. I am not sure exactly how this works but I believe it's firmware/driver dependent and Windows usually lacks the drivers to force the firmware into a protected mode. FireWire having direct access to the system ram is not a requirement of the 1.0 spec, it's a stupid implemention decision by chip designers.

It must have done it pretty recently then, because it's been vulnerable to this for a very long time.

Yes. http://www.irongeek.com/i.php?page=security/programmable-hid...

Plug it in, makes the OS think it's a keyboard while the user thinks it's a USB stick.