Are USB keyboard devices frequently pwnable?

I guess when we hypothetically get to devices having agents running on them that can figure out what the random attached hardware is, and craft "useful" takeover exploits for those, there will be some interesting adjustments to considerations.