Earlier quoted context omitted.
The bootloader is read-only. What the bootloader loads isn't. If the thing you're trying to boot into is faulty, it doesn't matter because you can just replace the thing the bootloader is trying to load. If the bootloader itself was faulty, the device would be bricked.
To elaborate on the alternative: When the bootloader is not read-only, you can upload another bootloader. This is great in a different way because custom bootloaders allow for more flexibility. For example, you may want to keep two copies of your firmware on the chip: One that you're uploading, and one you can fall back to if the most recent one has problems. This protects you against failure during firmware upload o…
By the way - real commercial MCUs have boot ROMs with connected watchdogs, trial boots, and recovery boot processes.