I don't have an iOS device to test, but just found a video [1] showing someone connecting a USB keyboard and immediately using it with no prompts. Same on Android.
Even better, here's [2] a direct example of this attack using an O.MG cable [3].
Android allows you to select the 'USB mode' between charging, MTP/PTP media transfer, debugging (if enabled), and filesystem.
If not an exploit, you need the victim to do something a lot more obviously (though the absolute obviousness of course remains debatable) dumb/risky than merely plug in.
“This fast charge station requires accessories access to your device for high speed charging”
Anyone who would believe a notice like that (or would click trust without thinking) is a prime target.
It’s like many scam/spam emails- they often intentionally look a bit dubious, poor grammar, typos etc as the attacker just wants to deal with low hanging fruit, not someone who may wise up quickly that something isn’t right.
iOS devices (maybe Android too, idk) ask you if you want to allow new accessories to access your device. That's why they said you need an exploit.