You can actually still do that: drawing 5V doesn't require the phone to mount as a drive.

So, what happens when a virus on the phone tells it to pose as a CD drive, and install a keylogger?

I'm pretty sure it won't mount that, either. The only external storage they'll mount are external hard drives that have been encrypted with their approved software.

The Social Engineering Toolkit's keyboard based malware deployment engine for Teensy could be repurposed for use on other USB devices.

I thought that was only common among smartphones.