You can pretend to be any vid:pid with usb gadget mode. For example with a raspberry pi zero something.

But you can't pretend to be any vendors id, only the ones with vulnerabilities. And the drivers or spyware will be downloaded by windows from the vendor's site, not from your peripheral.

But yes, usb device identifier is done through software/firmware.