It is legal for a person with an appropriate license, yes. But laws (in the US) about RF transmission differ from how many other laws are structured: We're only allowed to transmit what we have permission to transmit -- and by default, we're forbidden.

But right now, I've got an ESP32 WROOM module on a dev board sitting in my windowsill reporting some sensor values over wifi.

The WROOM itself is registered with the FCC[1]. If I stick to using the documented operation, then I have permission to use it in those documented ways. As a practical concept, I don't need a unique license to use it in the way that I am; I'm granted the ability to use it by Part 15 of the FCC rules.

And that's pretty great: The hardware was inexpensive to buy and very easy to find. I was able to spin this sensor up very quickly and get moving on the software side that deals with those readings. It has been a very rewarding little project with a fantastic cost:benefit ratio.

The fear being expressed here (which I don't necessarily subscribe to) is that things like this WROOM module will become less-available when/if methods to use it in undocumented ways are published and start becoming used.

[1]: https://fccid.io/2AC7Z-ESPWROOM32

Legal for end-user, sure. But Espressif might run into trouble with regulators like FCC.