Passthrough for Thunderbolt ports/controllers doesn't work the same like it does for USB. Thunderbolt devices appear in your VFIO list as separate items and therefore their device number/mapping changes depending on the TB devices that are plugged in.
I don't think you can passthrough an entire Thunderbolt controller either, whether it's a PCI-E expansion card or built-in.
Here's an excerpt of the IOMMU groupings from my old system (Gigabyte Z390 Designare) and what it looks like with a TB3 10G NIC plugged in that helps to show what I mean.
IOMMU Group 20:
07:02.0 PCI bridge [0604]: Intel Corporation JHL7540 Thunderbolt 3 Bridge [Titan Ridge 4C 2018] [8086:15ea] (rev 06)
IOMMU Group 21:
07:04.0 PCI bridge [0604]: Intel Corporation JHL7540 Thunderbolt 3 Bridge [Titan Ridge 4C 2018] [8086:15ea] (rev 06)
IOMMU Group 22:
08:00.0 System peripheral [0880]: Intel Corporation JHL7540 Thunderbolt 3 NHI [Titan Ridge 4C 2018] [8086:15eb] (rev 06)
IOMMU Group 23:
3c:00.0 USB controller [0c03]: Intel Corporation JHL7540 Thunderbolt 3 USB Controller [Titan Ridge 4C 2018] [8086:15ec] (rev 06)
IOMMU Group 24:
3d:00.0 PCI bridge [0604]: Intel Corporation JHL6340 Thunderbolt 3 Bridge (C step) [Alpine Ridge 2C 2016] [8086:15da] (rev 02)
IOMMU Group 25:
3e:01.0 PCI bridge [0604]: Intel Corporation JHL6340 Thunderbolt 3 Bridge (C step) [Alpine Ridge 2C 2016] [8086:15da] (rev 02)
3f:00.0 Ethernet controller [0200]: Aquantia Corp. AQC107 NBase-T/IEEE 802.3bz Ethernet Controller [AQtion] [1d6a:87b1] (rev 02)