You might not be able to read it in-circuit if some lines (i.e. OE / RD) are never Hi-Z even if you manage to hold everything else in reset.
I've been in a similar situation a few times and another (tedious) solution is to use a logic analyzer with sufficient channels to cover at least all the address bits , OE+RD lines, and as many data bits as possible (it's always possible to do multiple captures and reconstruct the actual bytes). If you're lucky, the firmware does a full ROM checksum at some point during boot, where you are guaranteed to see every location read from at least once.
On another board where it was impractical to do so without custom riser boards, I just took a chance and desoldered the EPROM. I got some serious cold sweat when I installed it in my tl866 and couldn't read it -- I had to disable "validate chip ID" or whatever the option is that attempts to identify the IC, and was then able to dump the contents.