SATA doesn't give you direct access to the DMA engine, the host decides where the data from the drive goes. If anything USB is probably more exploitable.
Well, the SATA controller has DMA access with the host. Of course, you have to find some way to trick the controller into misbehaving, but it's possible.
