In principle it should be possible by setting breakpoints at random (or sequential) addresses, immediately cancelling each one.
It would slow the target down a bit but not too much.
Traverse the address space for an hour...
One issue I see is that you have only a limited number of breakpoints, and you would quickly waste them on addresses which never get visited. So you would have to set one, hang around a bit, then clear it.
Does setting a breakpoint which doesn't get hit slow down the target?
The old ICEs were pricey for sure; I paud GBP 5k in 1985 for a Z180 one. But it was amazing. We managed to squeeze far more speed out of the chip, much of it by replacing specific IAR runtime code with assembler routines
Sometimes we got a 100x speedup, although to be fair in retrospect one could guess where.