My understanding from the description of the attack is that it didn't rely on any vulnerability in USB, only social engineering made possible by the Windows UI.