Or you can just write/add a second-stage bootloader after the ROM bootloader and get the best of both worlds?

By the way - real commercial MCUs have boot ROMs with connected watchdogs, trial boots, and recovery boot processes.