Siemens un-optimized addressing.....does this even work?

There is a little German company that has done an excellent job reverse engineering the S7 protocol, including all the bits nobody else has figured out, and has a pretty good OPC UA server for it: OPC-Server for common PLCs