ryrona I think I will try this out just to see
Yes, connecting a USB-A to USB-C hub into my Pixel phone, and then connecting both a regular USB mouse and regular USB keyboard made them both work perfectly fine to interact with the phone, without requiring me to approve those input devices first.
So, that means, any compromised USB port can do anything with your device you can do yourself, except scanning your fingerprint or guessing your PIN, so some security settings including enabling file transfer is still protected. But it could likely install a compromised app on your phone and give it all permissions and exfiltrate all your data that way.
So, don't connect your device in random untrusted USB ports, unless you have a charging only USB cable, or have changed the USB mode to charging only (even when unlocked).
As far as I know, QubesOS is the only operating system that has proper protection against USB initiated attacks, without disabling USB data entirely. GrapheneOS still protect against certain attacks by default, such as someone else than you plugging a malicious device into your phone, for example after having taken your phone. And you can enable and disable charging only mode (even when unlocked) as you want, so you can safely charge your device anywhere. As long as you remember to do that.