not a usb programmer, but are you saying i can buy any old usb chip and program it with any vendors ID and spoof windows into giving me admin? if so, gj micrcosoft.

You could use any programmable microcontroller with a USB interface. Consumer products tend to have fuses set to they can't be programmed again.

The latest driver registered with Microsoft for the product you're going to spoof would need to have a vulnerability to exploit. You can't supply any driver.

You can pretend to be any vid:pid with usb gadget mode. For example with a raspberry pi zero something.

But you can't pretend to be any vendors id, only the ones with vulnerabilities. And the drivers or spyware will be downloaded by windows from the vendor's site, not from your peripheral.

But yes, usb device identifier is done through software/firmware.

You can "spoof" any system where you can load older drivers into giving you admin/root, you just need to find a vulnerable driver. Nothing Windows-specific in that.