But yeah, as far as I can tell, the chip can only extract CSI from WiFi (unless there is some hidden raw I/Q sample debug mode or something).
I do have one question that wasn't quite clear to me, in case you happen to see this. There's a bunch of mentions of Channel State Information, but Google doesn't give a ton of info on it. So I'm just wondering, is CSI a "client-side" thing provided by the ESP32 for any Wi-Fi connection, or is it some special protocol feature that the AP or client have to enable?
For WiFi, some of the pilot symbols are called L-LTF (802.11g+n) and HT-LTF (802.11n). Every packet contains them as they are needed for successful communication. The ESP32 can provide channel estimates based on L-LTF and HT-LTF for any packet it receives. No need to enable anything, you can get CSI from every packet.