Controlling device peer-to-peer access from user space

It's the same vulnerability. To sum it up: PCIe devices can initiated read and write commands. Typically, those commands target system RAM (this is how DMA works). Devices can just as easily target Memory or I/O space in other devices.
The solution is the same: IOMMUs as firewalls between devices you want to segregate.

>could a rogue device read and transmit an entire drive with nothing on the system aware of it?
Yes. It's exactly the same hole as reading and transmitting system RAM without the CPU noticing (except that it's typically more involved to access disk data than it is to access RAM).