It seems that only at startup (boot) there is a data transfer between the EEPROM and the microcontroller, in rest, anything you do there isn't any data transfer. I couldn't capture the entire data on my scope (because it hasn't enough memory), but it's clear that at boot time the uC receives some ID of the model number and eventually some calibration data...
I don't have an EEPROM programmer, that would be the next step, to unsolder the chip and read its contents. And maybe it can be modified and written on another chip (because it has write protect).
And I also wonder if it can be done via SCPI commands (like the Rigol DS1052E) ...