Indeed the rabbit hole goes deeper. There’s this new thread over at Armbian where they looked into this issue (limited WiFi speed on BPi CM4 with the built-in rtl8822cs) and got it into the 100s of mbit/s: Slow WiFi speeds on Banana Pi CM4 - Banana PI CM4-IO - Armbian Community Forums
So I’ll look tomorrow what we can learn from that. If I do cat /sys/kernel/debug/mmc2/ios it really is at 25MHz and 3v3 signalling, while according to the thread it’s possible to run it at 200MHz 1v8.