That's a great point - modern drives are actual PCIe devices themselves, not the more restricted SATA protocol. The librebooted machine that I was talking abou

That's a great point - modern drives are actual PCIe devices themselves, not the more restricted SATA protocol. The librebooted machine that I was talking about has a properly situated IOMMU that should protect it against rogue PCIe devices (otherwise this same point applies to things like network card firmware). But it's important to keep in mind that many motherboards do not.