The only "defense" I can see working is having only one set of USB ports be permissible for human interface devices - if a legitimate HID is plugged into a diff

The only "defense" I can see working is having only one set of USB ports be permissible for human interface devices - if a legitimate HID is plugged into a different port, the OS just pops up a notification about an input device connected to a wrong port. If a malicious USB device is connected to a non-input port, then the OS pops up that notification and the user knows that something fishy is going on.