Is it possible to exploit this extension to get the pixel count? Does the hardware support it so that there may be hidden API to get access to the pixel count?
No, and no. Well, I supposed if you draw a series of one-pixel-sized triangle in window-space, you could count how many boolean values you get. But that would require a separate query for each one pixel. Probably not the fastest thing in the world.
If there's a "hidden API", you won't have access to it (since it's hidden), so it doesn't matter. Furthermore, the nature of the extension already suggests that there isn't. After all, if the hardware had the actual fragment count, why not just expose it directly, the way desktop OpenGL does? If the hardware supported it, they could have just taken ARB_occlusion_query and used that.
But they didn't. Which strongly suggests that they couldn't.