I looked at the code for one older version of the Companion module. It did actually use some non-MIDI messages for a few functions. So some peole have been able to determine at least some of the native protocol and/or messages.
However, that older module also hard-coded some things in a way that nearly guaranteed it would break with new versions of the firmware.