It's like that on Arch, and most everything by default. Standard practice - you often have to allow it explicitly via a group for unprivileged access to write to USB devices.

If you've played with custom keyboards it's commonly an issue there. You wouldn't want just any old program or webpage sending custom firmware to your keyboard!