I can't say that it's always the case, but all of the internal SD card readers I've looked at were actually USB devices - this puts them in scope for BadUSB.
Internally, an SD card is indeed very similar to a thumbdrive - and there have been attacks against them released. So they can be reprogrammed to change how they behave, just as you can a thumbdrive. So, there is certainly something to this.
Myself and Brandon Wilson released the first public BadUSB code - when we did this we also looked at SD cards, trying to see how they could be leveraged to perform similar attacks. The answer we came up with was that there wasn't a reliable way to do it.
The attack vector here would be a malicious SD card would behave in a non-standard way to exploit a vulnerability in the firmware of the reader - as it's the thing connected to USB, and potentially able to do more interesting things - in order to take control of the USB interface directly or apply modify the reader's firmware to facilitate further attacks.
The problem with this? You have to target specific readers (by controller & firmware version), which means that it has some value as a targeted attack, but can't be made reliable or generic enough to have a large scale impact. So we didn't pursue it in our research. Of course, it's worth noting that there aren't a huge number of companies that develop the controllers that the readers use, so there's some potential for targeting a relatively small number of common controller / firmware combinations and covering a decent percentage of the market.
So, to answer your question - it isn't a secure proxy, but it is a complicated proxy. If an attacker is able to learn about your specific configuration, and is willing to spend the money on research and development - it is possible. But, that said, if you are facing that type of attacker, there are almost certainly better options for them.
In general, pretty much everything that connects to USB, from mice to the internal root hub, are potential targets of BadUSB attacks. Some are harder to leverage than others - thumbdrives are ubiquitous and easy to modify, so they became the face of the attack, but they are far from alone. If it's connected to the bus, there's always a risk that it could be modified with malicious firmware.
It's been pointed out many times, but keep in mind that BadUSB isn't really a vulnerability, it's a feature. Everything that you see in a BadUSB attack is compliant with the specification - that's why there isn't an effective defense. The host has no way to know if the behavior is desired or not.
It's also important to remember that BadUSB isn't just devices showing up as another device type - it can change how the device behaves, while appearing to act normally. One of the demos that we released was a hidden partition that was only accessible if you know the right trick - we had also toyed with self-destructing drives, and drives that made a backup copy of anything deleted, so that even if the drive is formatted, it still can contain sensitive information (we didn't release these).
