Multi-function printers have reasonable computing power, and many are in fact linux devices, so it is theoretically possible that someone could use it to bridge into a network. It would make little sense to try it though:
- Slow access: most faxing happens at 9600 baud, that's really slow. Even if you could negotiate faster the best you could realistically hope for is 64k, which is still very slow
- Easily traceable: the internet allows for a huge amount of anonymity in attacks - an American hacker can attack a French company using a hacked Chinese computer and everyone will think it is state-sponsored espionage. However, dialing a phone line leaves a traceable record. Why would you take the risk?
- Attacks cost money: it's unlikely someone is going to dial locally to attack a company, so long-distance or international phone charges will add up. If the attacker is a phreaker as well then he/she won't be paying, but someone will, and they may investigate
- A printer suddenly accessing drive shares or scanning systems would stand out much more than a user laptop doing the same, it would be more likely to be noticed
- Low re-usability of attack: if I come up with an attack that works on say one line of HP MFPs then it will only work against those machines, not against Xerox, Canon, or any other printer model. In fact, the attack may only work on one line of HP, or even one model range. That's a great deal of effort for something that would only work on one subset of machines
- Easy to defeat: If I was worried about this all I'd need to do is put my printers in a network behind a firewall and prevent them from accessing anything. I'd also look at the phone records regularly
- There are much more effective and easier ways to attack someone: targeted phishing attacks against companies using 0 day or only recently patched vulnerabilities is far less challenging and much simpler to do than trying to subvert a printer over a phone line
The only time I could see concern for this being worthwhile would be in an environment which has no internet access however they did have MFPs plugged into phone lines. Even then an attacker is more likely to use removable media as an infection vector.