But is that remote DMA? Controller/driver-managed DMA transfers in the fashion of "shovel the next X incoming kilobytes to this memory range" is not the same as arbitrary writes to host memory initiated by a device.

On USB only Host is allowed to be a bus master. Thunderbold does PCI/PCIe and by extension allows any plugged gizmo to take over whole computer.