Yep, same problem exists over Thunderbolt connections afaik. By emulating PCIe devices you can basically coerce the host into giving you whatever you want from memory, as long as it's configured to conveniently do-so by default: https://thunderspy.io/