I've decapped an MM75 that I can get pictures of, if that would help. I've also got an MM76EL that I haven't decapped yet.
The 3870 has one test pin that you apply two different voltages to: one disables ROM and forces in an opcode to be executed, and the other enables ROM and outputs the databus to a port. I dumped them by forcing in the instruction to reset the data counter to 0, then continually forcing in a load memory instruction, which put the ROM byte on the bus and incremented the data counter. When dumping the ROM, the signals on the port are inverted and ORed with the ROM data, so you have to put $FF on the port when reading or else you corrupt the ROM data read.
The COP444L is similar- you force signals on the SPI data in and data out lines to get into 2 different test modes. One lets you force opcodes, the other dumps ROM continuously to a port. I didn't force any opcodes, just read in the ROM dump and figured out where the start was.