I wonder if this could be mitigated with a daemon that monitors USB devices and disconnects them (or even reboots entirely [0]) when an unexpected kind is connected. A workaround for a lack of permission/control in the OS, as it were.

Sure, attackers could connect something mimic a whitelisted USB vendor+product ID, but in that case the drivers/co-installers are probably already present anyway, and it still greatly reduces the attack-surface since they need to find an exploit in those particular products.

[0] https://en.wikipedia.org/wiki/USBKill