That is why, for example, it can properly process USB-PD messages that contain vendor defined message codes, even prior to any form of boot, as long as it has any source of power.
The firmware on the USB controller is processing that.
This is how VDMTool works to be able to mux debug (and do other things) even with the machine otherwise off.
If that isn't a "USB Controller" what do you mean when you say "USB Controller"?