What Is Qubes OS?

I was reading about Device Isolation but there's still something I'm not clear on:

Does the OS claim to prevent partially-trusted PCI devices linked to one VM from accessing memory of another VM? If so, how's that done?

I understand by default the hypervisor resets a device when it's moved from one VM to another, which would mitigate an evil device driver in the former from impacting the latter. But that doesn't protect from isolation breaches caused by evil [persistent] firmware.

I thought PCI cards have DMA access to all the system's memory space, unless you happen to have a server-type motherboard with a "smart PCIe bridge that can be programmed to perform address translation and access restrictions" (https://superuser.com/a/988179). Is such hardware more common now? Or does Qubes rely on all hardware you plug into it being trustworthy?

The iommu device is present on nearly all systems these days, even consumer ones. Intel calls it vt-d. The big issue is the device groupings that are setup by the firmware, and down stream pcie bridges. It's become more common because it's the only way to secure thunderbolt ports