Oh yes, one can execute code over the PCI bus just as well as you can load and store data. You just don't get a ROM on the PCI bus to appear in the legacy expansion ROM space at 0xC0000..0xEFFFF, where it must be to function as an expansion to BIOS POST as we know it. Put 32-bit protected mode code into such a ROM, call it from a 32-bit operating system, and you're set. But BIOS POST runs in miserable 16-bitty IBM XT compatible legacy mode with one megabyte of address space, so your card's BIOSes _must_ appear in said region ... and the only way to make that happen is to send system BIOS into 32-bit address space mode briefly, copy the ROM content from the PCI device into system RAM in the "right" spot below the 1 MByte border (which would otherwise be wasted anyway), return to miserable 16-bit mode, and invoke the copy in RAM.
At least gaining something from having to jump through that awkward backward compatibility hoop, the PCI specification demands that upon its first invocation, the shadow RAM location where it now is be _writable_ (!). This is so the expansion "ROM" code can dynamically create tables for their detected devices or whatever, and also allows the "ROM"'s init procedure to ditch code that's no longer needed after init (like SCSI configuration menus and such) and shrink themselves to save space at runtime. Only after POST is the shadow RAM then set to write protected, to again look like a traditional ROM at runtime.
In consequence, the code found on a PCI or AGP card's ROM _expects_ to be run in RAM, and would crash miserably if it weren't.
Can we settle that now? This is growing into a full blown theory lecture ...
regards, Peter