Yeah, I've worked on such chips where there is essentially a DSP with extra Wi-Fi specific hardware blocks on a shared memory bus. The DSP runs its standard assembly language and makes calls to the blocks, which are themselves configured with config registers or even a kind of microcode style assembly.

Those hardware blocks could be useful for certain applications but most importantly for triggering captures only when there are frames to process and giving you both the frame + the sample.

So for me the perfect hack would allow both normal Wi-Fi tx/rx and triggered or continuous rx sampling.