Could a 6502 CPU safely compute a SHA-1 hash in a reasonable length of time? The 6502 is the CPU in a Tamagotchi (which can be hacked to run custom code). SHA-1 is the default hash used for TOTP (the algorithm used by two-factor authentication tokens and apps). Hopefully you now understand why I'm asking this.

(given this context, this would be a couple dozen bytes of input, and less than a second or so of time)
Yes, a 6502 can compute SHA-1 in a reasonable time: less than $\lceil(k+9)/64\rceil/5$ second for a $k$-byte message on a 1 MHz 6502 as on the 1977 Apple ][. E.g. 0.2s for up to 55 bytes. We need like 128 bytes of RAM excluding the hashed message. Code likely fits 1 kbyte of code including constants.

Note: I do not know clock speed, RAM and code size resources on a Tamagoshi.

I'm basing this on a commercial implementation I wrote for the 8031/8051, another 8-bit CPU (from an old post). My 660-byte code (including tables and C interface) is well below 50,000 CPU cycles per 64-byte block (where many instructions on registers are 1 cycle, and external memory access is 2 cycles; one cycle lasts 12 external clock periods of the original 8051, common variants reduce that to 6 or less). That code is not optimized quite to the max for speed, because the customer was short on easily addressable internal RAM, and code size was a consideration too. On the 6502, I estimate the number of CPU cycles would be less than 4 times that with unrolled code using zero-page addressing, that is less than 200,000 cycles. I would not be surprised if things could be brought down to 120,000 cycles or so. I second Poncho's comment that 83,700 cycles seems rather optimistic.

The most natural code is constant-time, thus at least a side-channel by timing is easy to avoid. Probing, and power/electromagnetic emission analysis are credible security threats, if an adversary can approach the hardware.

Note: I know no security CPU that used the 6502, but many have used the 6805 or derivatives, which are very comparable 8-bit CPUs. Some are still in active use.