I have now spent (too much) time trying to find out why the controller becomes unresponsive in that situation. The answer: The game reads the controller both in the main game loop
and in the NMI handler. In fact, the NMI handler's controller read procedure
interrupts the main game loop's controller read procedure. Since the controller is read by writing 1, then 0, to $4016, then reading $4016 eight times to get the result of the eight buttons (four buttons and four D-pad positions, actually), this implies that if a controller read procedure from the main game loop is interrupted by a controller read procedure from the NMI handler, the interrupted controller read procedure will read not the 1st-to-8th bit, but a 9th+ bit, in other words, it's basically a garbage read result. The game commits a logical error by having two controller read routines that can interrupt each other.
Now, why does it still work on VT02, but not on regular NES/Famicom? Actually, in NintendulatorNRS, it works on VT02
and with Dendy timing, but not with NTSC or regular PAL timing. Apart from frame timing, NintendulatorNRS will also emulate the controller behavior of a famiclone in VTxx mode and in Dendy mode, while emulating the Standard Controller behavior of a licensed NES or Famicom in NTSC or regular PAL mode. What is the difference in controller behaviors? The difference is that Nintendo controllers return "1" when a 9th bit and above bit is read, while famiclone controllers return "0" when a 9th and above bit is read. The game, despite being buggy in having two controller read routines that interrupt each other, will still work with famiclone (Dendy or VTxx) behavior because it's not bothered by the "0" bit, but is bothered by Nintendo controller behavior, because it sees the garbage "1" bit as a "phantom" START button press.
Long story short: Run the original extracted ROM in Dendy mode, or use the patched ROM that I created, which fixes the double/interrupting controller read behavior.
Edit: Regarding the full 270-in-1, it does not run unmodified because we lack the dump of a 256-byte serial security ROM. When patching out the security checks, it's not a pretty looker, either, as the attached pictures show. The mock-up screenshots in
Amazon's item description indicate that my emulated colors are correct.