Hypothetically, software could be fed false outputs from timer-register reads in much the same way as it is fed false outputs from privileged instruction calls

Hypothetically, software could be fed false outputs from timer-register reads in much the same way as it is fed false outputs from privileged instruction calls in VMWare. I am not aware of any publicly available emulator which does this, however. Alternatively, one could use automated means to find sections of a binary which behave in a logically distinct manner (branch differently in at least one place) when emulated instruction timings are twiddled. Then turn the disassembled section red in your debugger and attack it manually.