Hmm I verified that all 8 bits that go into PIx comes out RIOx. Though, interestingly, the bits are swapped around a bit.

I am guessing this is going to work similar to the F8 microcontrollers where you get access to the internal CPU's data bus. So theoretically you feed instructions into the chip using the PI pins and then make it do load or store instructions or whatever, and then turn the ROM enable on at the right time to snag the ROM data. If there's some way to run the ROM code and get access to the bus it'd be easy to slurp the ROM contents this way and make it execute jumps to get into new banks to read the entire ROM.