Sensors are projected to the head surface (conceptual reasoning is because voltages are measured on the scalp in reality; practical reasoning is that the voltages are computed on the outermost BEM or sphere shell in the forward code).
No way to extract AFAIK. We should maybe add a montage.project_to_scalp(...) or similar, would be a neat add. But the heavy lifting is done by a private function, so assuming you get the scalp surface (should be a smoothed / decimated one!) transformed to head coords you can use something like:
eegp_loc, eegp_nn = _project_onto_surface(
sens_loc, head_surf, project_rrs=True, return_nn=True
)[2:4]
it’s what we do in mne/viz/_3d.py. But of course this is private code so to future proof it, the public method proposed above would be much better to implement!