Is it possible for a cartridge to take over the 0800-1FFF address space to increase the base system RAM?
Maybe it could possibly trap the writes, but what about reads?
Multiple memories responding to a write to the same address is called "snooping", and the MMC5 is believed to snoop PPU port writes to figure out what the main program is doing. Multiple memories responding to a read from the same address is called a "bus conflict", which can cause stress on integrated circuits.
Cartridges can expand RAM at $4020-$FFFF, as these addresses are guaranteed not to conflict with anything in the Control Deck. Most do so at $6000-$7FFF, though FDS and MMC5 are also capable of mapping RAM into $8000-$DFFF. If RAM is mapped above $FF00, where the reset vectors live, there needs to be some means of switching to either ROM or a program-generating MCU at power-on until the initial program loader (IPL) has had a chance to load a program into RAM.
The CopyNES actually substitutes its BIOS at $1000, if I recall, but this requires a serious mod that puts it in between the CPU and its motherboard.
No, it is unsafe for the cartridge to get the CPU-dedicated SRAM off the bus from addresses $0800-$1FFF. A cartridge could intentionally drive the address lines low, just like ordinary bus conflicts on the data line, but that doesn't get you away from the CPU-dedicated RAM. (A cartridge cannot safely overpower the address lines high)
The CopyNES tricks the mainboard into thinking it's doing I/O from $48xx-$4Fxx instead when it's actually accessing the CopyNES BIOS (which is, as said before, mapped at $1xxx and $3xxx)