Pins 0x02-0x10 on Bangle.is io expander actually unused?

I want to try to shove a new device into my Bangle.js, but unfortunately they only come in SPI flavors. Since the GPIOs on the nRF52 appear to be completely occupied (https://www.espruino.com/Bangle.js+Technical), I doubt I could use the internal SPI interface nor do I really want to muck around what appears to be interfacing with the flash memory.

Someone turned my on to the idea of bit banging an SPI interface, and I just may be able to do that his for seemingly unused GPIO pins on the io expander. Before proceeding, I wanted to ask the community if they'd toyed with these pins.

spi over the (i2c?) expander may be slow. spi can be shared with otherdevices you just need extra CS pin and have just one of them selected. On P8 smartwatch (or PineTime) the display and flash use shared spi pins and it works pretty well even when espruino code is executed directly from spi flash. It just needs to be careful with CS pins.

I suppose it's worth it to try that first.

The pins on the IO expander might be free, but I think it'll be very difficult to connect to them.

One potential option which should be pretty easy to get to is the HRM and the buttons. The black flex cable for those is soldered to the PCB and is reasonably course pitch so can be soldered to quite easily.

The pins are inverted in software inside Espruino, but other than that, when the buttons aren't pressed down the pins are effectively free to use.