Apparently, someone was thinking along exactly the same lines, and asked pretty much these exact same questions 10 days ago.
There is apparently a script called qubes-pciback.sh which runs really early during startup, before devices are initialized, and assigns the network and USB controllers into a dummy “pciback” driver that does nothing, so that the devices cannot be claimed by the real drivers. The network PCI devices are always assigned to pciback, USB controllers if the “rd.qubes.hide_all_usb” grub option is supplied, which it is for me.
So, a compromised network or USB controller device should not be able to do any harm to dom0 at all. They are attached to dom0 though, there just won’t be any driver talking to them, so it is more or less like if they weren’t assigned to dom0 at all.