I had an interesting idea: for ROMs which won't dump the 8th bit electronically, can we dump said bit via power/current analysis?
The problem with the TMS1x00s is the fu FET, which probably obscures any current differences. Also, the TMS1x00s dump the ROM bits serially, so the summing trick wouldn't work.
I think that there must be some way to turn off the fu FET; there are easier ways that they could have disabled ROM dumping. I've tried playing with timing and voltages, but haven't had any luck. And I know Kevin has looked into it, too.