Yes and no. So, it really depends on what you're defending against: if your concern is solely about an attacker using the GPU to compromise the CPU, then IOMMU

Yes and no. So, it really depends on what you're defending against: if your concern is solely about an attacker using the GPU to compromise the CPU, then IOMMUs get you a lot in terms of restricting what's possible -- sure, an attacker could find some buffer somewhere in the accessible address space that they can use to attack the CPU, but it's another barrier. But if you think about what's on the GPU itself -- all your UI elements (in many cases), your webpages, etc -- it suddenly makes that data seem very important; if I can get you to go to a page that will let me grab all of your running windows, then suddenly I may very well have things like your passwords, credit card info, etc (all depending on when I grab the data and how often that data gets flushed out). I think that proper protections should be put in from the hardware on up through the drivers, but it's going to take a lot of work and a lot of research to get it right.