[the8472]

That's for a specific firewire protocol.

Thunderbolt exposes PCIe-lanes, so you can pretty much attach any pcie-device that has drivers. If there are any drivers that do not use the IOMMU properly (just pass through everything?) then we're back to square one. And I don't think all drivers are iommu-aware.

The system should only hotplug devices/drivers with user approval.