Apple is being forced to pay lip service to serviceability, but it needs to be pressed further.
https://www.notebookcheck.net/Opinion-Horizon-Machine-or-not-Apple-still-only-pays-lip-service-to-repair-service.228710.0.html
I would think most professionals would be quite happy with Thunderbolt3 as long as it works as it's supposed: you can plug in some extender which might have PCIe, PCI, maybe even ISA ports (why not, if you can have ISA->PCI->PCIe adapters). All while having the IOMMU maintain security (atleast that's the theory, time will tell how secure it truly is).
https://cloudplatform.googleblog.com/2017/02/fuzzing-PCI-Express-security-in-plaintext.html
This post suggests "good enough for now", atleast some testing was done though I don't want to give too much credit since it's possible they just tried the few obvious vectors while there might be dozen others not yet found.
The post does also suggest that it's likely some legacy devices you might be able to plug in through TB3 ports into external cage might not work if the IOMMU for the TB3 is configured in secure manner. I'm not sure but it sounds like that from that post.