Yes it does, look at include/ddk/usbscan.h in mingw32, or MSDN's STI/WIA documentation, the section on USBSCAN.SYS. Reading and writing do raw bulk pipe transfers, ioctl's do specific things: particular ioctl's (USBSCAN_READ_REGISTERS, USBSCAN_WRITE_REGISTERS, USBSCAN_SEND_DEVICE_REQUEST...) build and send control pipe USB packets. I did implement the kernel module and it really works, in case I forgot to mention it.
Although it will surely work for scanners that use that code, there's no way to guarantee that all scanners behave that way. Their implementers are free to code whatever they want in the driver. So while this solution works for devices that use the usbscan.sys, it doesn't cover other devices. I don't know any statistics about who uses usbscan.sys and who doesn't, so maybe it's all a moot point.
Kuba