> I thought this required me to unlock my phone and say 'I trust this computer'
It does, but only once, and then it's almost impossible to "un-trust" the computer without wiping your phone. Besides, you probably have already "trusted" your home computer -- which could be exploited between then and now and then used as a vehicle for attack.
And, as some commenters have mentioned, when you plug into a new device, use an airplane USB charging port for example, the phone may repeatedly ask you to accept a pairing with the other side (the USB charger/device), and an accidental tap on the wrong button can leave the door open.
The only physical access that is required is for the user to pair with a/some pc -- which then said pc can be used as a vehicle for attack...
Other users in this thread have mentioned airport USB chargers wanting to pair with their iDevice, etc.
That's not very far-fetched really...