[tga_d]

I know thunderbolt at least up through 3 was generally carte blanche DMA, so an obvious security nightmare (strictly speaking no worse than cold boot attacks and the like, but there's a practicality difference between dumping raw DIMMs and just plugging in a thumb drive -- or inter-machine links like TFA, for that matter). Does TB4 bother trying to solve this?

[p_l]

Not really. Just like with OHCI 1394, it's responsibility of host IOMMU to handle it.