Intel gave us the IOMMU but OSes haven't been using it.

Intel didn't stop using IOMMU support for product segmentation until a month after Windows 10 was released. It's really no surprise that operating systems have been slow to make use of a feature that is still unavailable on a large part of the install base.

I have been warned against turning on IOMMU because the code to operate it is so little exercised, and therefore buggy. A crashed kernel is secure only in that it stops running.

On the other hand IOMMU helps protecting system memory not just against malicious but also faulty devices that could otherwise write anywhere.

And people who use GPU passthrough rely on IOMMUs, so it's not like those code paths are not being exercised.

Using IOMMU through the "userspace PCI" vfio driver, as done in pass-through scenarios, is a different path than using it through the DMA API.

IOMMU is also exercised by Xen PCI passthrough (e.g. QubesOS network and USB driver VMs) and SR-IOV (e.g. AWS Nitro networking).

The problem isn't bugs in the IOMMU, it's bugs or performance issues in using the DMA API with an IOMMU.

Well, they have used it a little, but it’s hard to use it enough.

You need to ensure that different network cards can’t see each other’s buffers, for example, and that will not be an easy change to most OSes.