Turns out this behavior was caused partly by a custom setting in the
libvirt Debian package. Setting it to true should have been enough to
allow automatic redirection of any newly plugged in USB device but it
still doesn't work.
My guess is that something else (in polkit?) is preventing the desired
action but I don't know what.
https://bugzilla.redhat.com/show_bug.cgi?id=1151798
The responsible config file:
/usr/share/glib-2.0/schemas/10_virt-manager.gschema.override
[org.virt-manager,virt-manager.console]
auto-redirect=false