if they have enabled the readback protection.. then its not possible.. or u have to decap it.. or spent money for a decap service...
1740432855
An other possible option is to reach the SPI flash..
Ill think its also protected, the SPI from Esp32S2 is connected with the Ice40 SPI.
So far i know...