Isn't this just an instance of "trusting trust?" How do you know the IOMMU hasn't been backdoored? "Open" firmware doesn't mean open RTL. Where is the line drawn?

Just an example, DARTs and IOMMUs help close down that line of attack but there are still many proprietary and inscrutable blobs/peripherals/monitors that alter the behavior of modern computers which are almost impossible to avoid in general.