Everything is now software.
USB controller chips in USB devices may have switched from ASICS to uCs, and so can be re-purposed to do their designer's bidding. Security scan your 32GB flash drive as much as you want, you won't find this. Maybe you shouldn't turn your back on your mouse, lest it suddenly pretend to be you.
Mobile phones will have another layer of (re)programmable base-band chipsets below the OS. They could contain malware, just not as we know it Jim.
It's hopeless. You can't even trust the kit brand new in the box.