They can't query it, they have to be listening when it broadcasts.

Yeah ok I understand that it doesn't have a memory. But you can still sort of "query" the current state of a device that is always broadcasting, like a flow or speed sensor.

The router's probably pinging beacon frames out several times a second anyway. There's a lot of 2.4GHz traffic a passive listener could use.

You could presumably use existing devices for that, but it would require making a serious software change - in particular, you'd have to alter the radio driver to listen to and recognize backscattered signals (instead of rejecting them as noise).