One would imagine that raid cards would be an equally appealing attack vector.
There are driverless/non firmware upgradeable RAID controllers, for example Sil3726 - SATA port multiplier with RAID functionality buildin. Connect couple of drivers and host sees only one.