You almost certainly cant transmit legally, though (unless you have a amateur radio license, which lets you do all sorts of stuff with useful amounts of power).
First, as a ham radio operator, no, you can't just go and start blasting away from an SDR even in the ham bands. You have to follow strict rules, including a non-commercial content rule and you must not use encryption. The ham bands are for people to experiment with new radio technologies and more importantly communicate with one another using those technologies on a hobbyist level -- encryption and commercial use does not help those goals.
That being said, there are chunks of radio spectrum that are effectively "public domain" where you can transmit within certain ERP (effective radiated power) limits without the ham band restrictions on content, protocol, etc. Traditional WiFi lives in one -- the block set aside for microwave cooking devices, and therefore with a near-unusable noise floor for anything but short range communication like household WiFi.
is it like a settings file?
Binwalk, IDA pro, etc. All the normal reverse engineering tools.
>are they a threat vector?
Absolutely.
>is it like a settings file?
No, it's code executing on the WiFi card.
Besides a hex editor, probably not.
> are they a threat vector?
As much as any other opaque software (i.e. not FOSS or otherwise transparent around source code auditing by arbitrary third parties). That is, in short: yes.
> is it like a settings file?
No, it's more like the operating system for the wireless card itself, running on the card's own microprocessor.
For Intel Wi-Fi, FreeBSD includes the firmware out-of-the-box, many Linux distros do the same I'm sure.