If the OS's autorun is turned on. and a cellphone is plugged in (but is not selected on the cellphone to act as a storage device), Windows autorun does not activate.
In such a case, does that mean that even if the cellphone does have a virus that could jump to windows, that it wouldn't unless the smartphone is selected to behave as a storage device?
As always, the vast majority of times viruses are the least of your concerns.
USB ports are inherently insecure and you should threat them like that, that is, only plug trusted devices.
Connecting a phone as an storage device is pretty much harmless, as it's only just an extra drive for Explorer to peek. Problems can arise in that case from a malicious file that you run or a file that exploits a bug in Explorer (rare these days, but still possible).
Without being an storage device, the phone still poses some menaces if you don't trust it. As the USB port basically trust whatever the device says, the phone could identify itself as another device, like a keyboard or a network card to try to attack the host. Those things on a sane phone are out of the picture, but a compromised one can certainly attempt those.
Even without an USB connection, if you connect it to the network though wifi, the same risks appear as with any other computer. A malicious program on the phone can try to sneak though shares or vulnerabilities.
Bottom line, if you don't trust the phone, don't plug it at all. Use a normal wall adapter instead.
Quote