Comment by allegory

Very good points there. I worked for an aerospace and defence company for a bit as an electrical engineer. Our software was always read into RAM, checksummed, the RAM was write protected via a register and only then the code was executed. The bootloader was a mask ROM. That was all just to work around the possibility of bit flips in EPROMs.