Previously, if a USB device was plugged in it then it might work or it might not work and the kernel had to sanely handle both of those cases. The shift is that

Previously, if a USB device was plugged in it then it might work or it might not work and the kernel had to sanely handle both of those cases. The shift is that now the kernel has to handle that USB device actively trying to do something nefarious. Designing code to be resistant to active malicious attack is very different than just handling error cases for things that don't work.