You joke, but the IoT project I used to work on had a bootloader system that kept 2 firmware versions of our software in memory. If the "main" one entered a restart/crash-loop it would auto-revert to the old firmware.
If you don't flash the bootloader too you don't "own the glass".
EVERY well-designed IoT device works this way. It's absolutely required for any kind of safe OTA firmware updates, especially fro any kind of infrastructure equipment, where physical access to the hardware is not at all guaranteed.
Yeah, I am not sure if they use the same standards for consumer electronics though. In our case it was for trucks that could be in very remote locations.
Yeah I don't think there's that level of thought and planning and skill going into each of these devices.
I suppose they could be putting some of their pervware within the ARM TrustZone, but that seems excessive.
Something like virtualization? SMM? IPMI? Who knows.