This has been exploited by pornography scams. An attacker Web site sends Java code to hang up the porn surfer's modem. It then forces it to redial a long distance number in a country that has some sort of 900 service. Let's say you're absolutely certain that none of your modems can be forced to take incoming calls. They are still vulnerable to insider attacks, which remain the most serious class of computer crime.
Insiders also do more damage than the average outside attacker.
So the biggest threat modems pose may well be what someone can do by using them to dial out. For example, consider the case of a computer criminal who gains a brief entry through an Internet-based attack and discovers and reconfigures a modem for later use. Whether the attack comes from inside or out, an attacker has much to gain from a modem that doesn't have an intrusion detection system or a firewall to defend it. If you have many young IT professionals in your company, you probably have at least one who is a Linux evangelist. Linux is cheap, reliable and powerful.