By adding
P0SEL = 0; // Configure Port 0 as GPIO
P1SEL = 0; // Configure Port 1 as GPIO
P2SEL = 0; // Configure Port 2 as GPIO
P0DIR = 0xFF; // All port 0 pins (P0.0-P0.7) as output
P1DIR = 0xFF; // All port 1 pins (P1.0-P1.7) as output
P2DIR = 0x1F; // All port 1 pins (P2.0-P2.4) as output
P0 = 0xff; // All pins on port 0 to high
P1 = 0xff; // All pins on port 1 to high
P2 = 0xff; // All pins on port 2 to high
to "main", between HAL_BOARD_INIT() and HalDriverInit(), I was able to lower the current to 2.66mA. I guess I need to figure out how to dynamically turn the SPI and DMA off and on. Does the BLE stack supports dynamically "closing" the port then reopening it? Who calls NPI_InitTransport?
[Actually, that is not quite true: if I power on the MCU board which in turns powers on the CC2541, I get a 10.54mA current. If I then start debugging the HostTestRelease then quit the debugger, the idle current is 2.66mA.]