After opening Wio Terminal I saw a pad pins near the Buzzer with these labels:

SWDC SWDIO SWO RST GND 3V3

Then I soldered a DuPont femea wires and connected to JLink this way:

SWDC SWCLK 9

SWDIO SWDIO 7

RST RESET 15

GND GND 4

3V3 VTref 1

Then used JLinkExe to dump the original firmware:

$ JLinkExe -if swd
SEGGER J-Link Commander V7.92a (Compiled Aug 16 2023 15:34:10)
DLL version V7.92a, compiled Aug 16 2023 15:33:47

Connecting to J-Link via USB...O.K.
Firmware: J-Link ARM V8 compiled Nov 28 2014 13:44:46
Hardware version: V8.00
J-Link uptime (since boot): N/A (Not supported by this model)
S/N: 268006167
License(s): FlashBP, GDB
OEM: SEGGER-EDU
VTref=3.306V


Type "connect" to establish a target connection, '?' for help
J-Link>con
Please specify device / core. <Default>: ATSAMD51P19A
Type '?' for selection dialog
Device>
Specify target interface speed [kHz]. <Default>: 4000 kHz
Speed>
Device "ATSAMD51P19A" selected.


Connecting to target via SWD
InitTarget() start
SWD selected. Executing JTAG -> SWD switching sequence.
DAP initialized successfully.
InitTarget() end - Took 6.19ms
Found SW-DP with ID 0x2BA01477
DPv0 detected
CoreSight SoC-400 or earlier
Scanning AP map to find all available APs
AP[2]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
AP[1]: AHB-AP (IDR: 0x74770001)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0x41003000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ 41003000
[0][0]: E00FF000 CID B105100D PID 000BB4C4 ROM Table
ROMTbl[1] @ E00FF000
[1][0]: E000E000 CID B105E00D PID 000BB00C SCS-M7
[1][1]: E0001000 CID B105E00D PID 003BB002 DWT
[1][2]: E0002000 CID B105E00D PID 002BB003 FPB
[1][3]: E0000000 CID B105E00D PID 003BB001 ITM
[1][4]: E0040000 CID B105900D PID 000BB9A1 TPIU
[1][5]: E0041000 CID B105900D PID 000BB925 ETM
[1][6]: E0042000 CID B105900D PID 003BB907 ETB
Memory zones:
  Zone: "Default" Description: Default access mode
Cortex-M4 identified.
J-Link>savebin /tmp/upload.bin, 0x0, 0x80000
Opening binary file for writing... [/tmp/upload.bin]
Reading 524288 bytes from addr 0x00000000 into file...O.K.
J-Link>