You'd get assigned a VendorID if you have a USB license: That is a USB-IF thing, not a Microsoft thing. Then each licensee gets to assign its own ProductIDs.
There is no authentication in the core USB protocol: A device can declare any VendorID. Major microcontroller board manufacturers such as Sparkfun and PJRC provide specific VendorID/ProductIDs to be used by DIY projects using their boards ... but I've seen some of those being reused by other boards. I have also seen the VendorID 0xf055 used by free open source firmware.