Or hook up a counter (reset + clock signal, that's 2 gpio's), and feed counter output to address lines.

If you're really short on gpio's, you could do the same with the data outputs (use some parallel in, serial out shift register, or a multiplexer that selects which data bit(s) to read).

Updated. Curious about how you wound up tying all 30+ pins on the pico (26 gpio)

You can put that nor flash into byte mode, saving you 8 data lines in exchange for an extra address line.

You can also throw a shift register in to increase the number of GPIOs.

Yes, I suppose this would be a functional way to do this. It would take much longer (double or quadruple depending on data bus size). But none the less, it could work.

I think you'll find that even that is much quicker than twiddling lines via boundary scan. At best, JTAG boundary scan is basically one giant shift register generally hundreds to thousands of bits long. Every cycle you'd need to shift out the whole thing even if you change the state of one signal.