As already mentioned the IO would be there in opposite to KIM-1 even with a working PB6.
More interesting for me are the cases that use the timer of the 2nd 6530.
If it's up to 5 I would say manual patching is the way to have a VIA Timer compatible version.
If its between 5 and 9 it's worth to create some scripts for auto patching.
If it's 10+ I would look into building some 74 TLL replacement, my estimation is that it needs between 5 and 10 ICs.
My idea was to optimize the tape interface (Hypertape) and make it like the one on the C64 and other with motor control and switch sense.
I have some other plans for much cheaper mass storage solutions so I don't care for the Corsham SD-Card extensions.
The VIA counter has a range of 0-65535 while the RIOT hast a pre-divider of 1, 8, 64 and 1024 and can count from 0-255 what means effective 0-255, 0-2040, 0-16320 and 0-261120
That means as long as the pre-divider of 1024 is not used the VIA can emulate the RIOT counter easily. If it is used you still can let the 6502 count to 4.