Running update-usbids by default isn’t an option because users don’t necessarily want their systems to “phone home” in any way (which update-usbids does, even if the download URL is currently trustworthy), and Debian avoids configuring them to do so.
I imagine the package maintainer didn’t think of uploading a package with an updated list of ids before the Debian 9 freeze in early 2017. The package which was released in Debian 9 was uploaded in 2015, so the age of the database makes sense. You might think that the package could update its own database during the build, which would allow an automated rebuild to update the database for everyone, but package builds aren’t allowed to access remote hosts.
Later releases of usbutils switched to the systemd database. The switch to systemd in general meant reduced support for sysvinit-based systems; supporting those is still a requirement for Debian, so the newer packages were only uploaded to experimental until recently. Debian 10 will feature a newer release, using the systemd database.
If system administrators wants to update the USB identifiers, they can add a monthly cron job...