PCIe is a bus. It is the drivers that would choose to read and execute option ROM. It isn't part of the protocol actually. If your peripheral device is comprom

PCIe is a bus. It is the drivers that would choose to read and execute option ROM. It isn't part of the protocol actually. If your peripheral device is compromised by a third party (say NSA) then it doesn't matter if it is over wireless or cable.