> are there tools for parsing the firmware bin?

Besides a hex editor, probably not.

> are they a threat vector?

As much as any other opaque software (i.e. not FOSS or otherwise transparent around source code auditing by arbitrary third parties). That is, in short: yes.

> is it like a settings file?

No, it's more like the operating system for the wireless card itself, running on the card's own microprocessor.