You can put that nor flash into byte mode, saving you 8 data lines in exchange for an extra address line.

You can also throw a shift register in to increase the number of GPIOs.

Yes, I suppose this would be a functional way to do this. It would take much longer (double or quadruple depending on data bus size). But none the less, it could work.

I think you'll find that even that is much quicker than twiddling lines via boundary scan. At best, JTAG boundary scan is basically one giant shift register generally hundreds to thousands of bits long. Every cycle you'd need to shift out the whole thing even if you change the state of one signal.