It doesn't matter whether the device is USB or Bluetooth, nor does it even matter if the device is a keyboard - the same potential attack vector applies. I'll focus on USB here since I'm more familiar with USB HID then I am Bluetooth device endpoints.
When a USB device is connected to the system, the host asks it for its descriptor. The descriptor is effectively a big block of data that tells the host what it's called, what USB features it supports, what interfaces and devices it implements. One physical USB device connected to one physical USB port may in fact report itself as multiple devices, each with its own functionality. This is how combo devices like keyboard/mouse or USB-C touchscreens work.
A malicious device could implement a USB HID (human interface device) keyboard alongside its "normal" functionality, and send whatever keys it likes to your system. This is how devices like the USB Rubber Ducky - they look like a USB stick or something else innocuous, but inside they've got a small microcontroller that implements a USB keyboard interface that you can program to send whatever keyboard strokes you like when you plug them in. A common payload is to hit the necessary keys to launch a run prompt, then execute commands that download a reverse shell script, giving the attacker complete control of the system.
You can take this one step further with something like the O.MG cable, which looks and acts just like a regular USB cable but actually lets you remotely send keystrokes over an 802.11 WiFi access point built into it. Same attack but with interactive control.
There's pretty much nothing you can do to prevent this attack, other than carefully auditing the USB devices that are exposed by the device, or perhaps implementing a USB device security policy on your system if the inconvenience isn't too great (it probably would be for general users).
The answer to "why isn't everyone freaking out about this" is that almost no attackers want to invest in costly and risky supply chain attacks on peripheral hardware unless there's a very high chance of getting high value returns. It's something that you need to consider in nation state infrastructure, but for corporate stuff you can get by with device lockdown policies and monitoring, and for home users there's basically no reason to waste this kind of attack.
