I don’t know enough about the charger thing to comment on how viable that might be for an attack vector.

But you’re definitely right about plugging your mobile device into random ports. Either set your phone to by default only charge and not communicate, use a charge-only cable, or only use your own power bank/charger when away from home and you don’t fully trust where you are…