It was an older flaw in Thunderbolt ports that could do this. Thunderbolt had the ability to request raw memory blocks over the DMA bus, which worked at the hardware level, completely bypassing the operating system. I believe this has since changed though.