I just ran an experiment. I have nothing connected to my IOM port, so the read transfers is going into oblivion. But that means that no one is possibly driving MOSI except the IOM itself. I did a single byte ‘read register’ transfer. The read register transfer begins with a write of the [fake] register address on MOSI, then the read is performed after the register address terminates. I see the register address go out, followed 8 more clocks while the IOM reads from the non-existent device. As you have observed, MOSI is ‘0’ during the read operation. I then added a 20K pullup to MOSI, and it is still ‘0’ during the read byte. When the transfer completes, MOSI goes high again. The only possible reason is that the IOM itself wants MOSI at ‘0’ during the read operation.
If you really need MOSI at ‘1’ during a read, maybe you need to do a full duplex read transfer where the outgoing TX buffer is all 0xFF bytes.