> Maybe bare serial (just a wire per tx/rx), but it suddenly occurs to me that I don't know how that's actually connected to the CPU
In practice today, if you have a DB9 serial port, that goes into the section of the chipset which is concerned with all the "legacy" interfaces, which ultimately turns up on the PCIe bus like everything else.
> I think that approaching this from a security angle is a quick road to madness
Yes.