No need — I simply plugged into the exposed programming header on the gateway.
The sensor has an Atmel SAMD part which I assume has the security bit set. I didn't need to dump that firmware directly as it exists within the gateway flash.
The gateway had an open debug port?!?!
The 8266 has no flash readout protection, and the UART is exposed on a programming header. It was very easy to dump the firmware.