First time poster, long time lurker. Thanks for all of the helpful info here!
I spent way too much time reverse-engineering the SCPI dispatch tables in the 58131/58132/58181 firmware yesterday, and discovered the secret to enabling the hidden menu, which I haven't seen documented elsewhere.
To enable the menu, send SCPI command
DIAG:SYST:HMAC 1
Then power cycle while holding +/-, and you'll get the menu which allows you to see the team members names, enable serial debug logging, enable the pForth interpreter on the serial port (!), dump the current cal security code, etc. The SCPI command seemingly only enables the menu for one power-cycle, but any changes you make there seem to persist. Oh, and the counter doesn't respond to the message so you'll see a timeout, but it still does appear to work.
This works on my 58132 with rev 4613 firmware and my 58181 with 4608 firmware, though the menus are slightly different.
For bonus points, there's also
DIAG:OPT:HFR?
which prints out the type of high frequency option is installed (030/050/124); my '32 with no option prints +0,NONE,0 and my '81 with the 3GHz option prints +128,N030,0. There also looks to be a DIAG:OPT:HFR command that will set bytes in EEPROM, but I haven't played with this yet, as I don't have a backup of my counter's EEPROM.
I'll probably keep poking through the firmware and update this thread with any other fun stuff I find.