Is there something like an IOMMU to provide secure access to the NIC?
Yes, DPDK (which VPP is built on) heavily utilizes IOMMU to provide host protection.
https://doc.dpdk.org/guides/linux_gsg/linux_drivers.html discusses it a bit.
https://doc.dpdk.org/guides/linux_gsg/linux_drivers.html discusses it a bit.
This isn't the case because VPP polls the NIC from userspace and never enters the kernel. There are no context switches.