I don't understand how code on a USB drive can be executed on a PC. I seriously thought that USB was (as a protocol) a generic data interface. However, if it i

I don't understand how code on a USB drive can be executed on a PC. I seriously thought that USB was (as a protocol) a generic data interface. However, if it is something else (like, e.g., something that executes code from time to time), isn't it insecure by design? And if so, why did nobody see it and was it malice or stupidity?