> It seems like a misdesign if it's possible to destroy all of the firmware, including the backup. Humor me; how would that work? If anything, I'd expect it to

> It seems like a misdesign if it's possible to destroy all of the firmware, including the backup. Humor me; how would that work? If anything, I'd expect it to be easier to overwrite the inactive slot (assuming an A/B setup, ideally with read-only root). If you really wanted, you could have a separate chip that was read-only enforced by hardware, and I've seen that done for really low level firmware (ex. Chromebook boot firmware) but it's usually really limited precisely because the inability to update it means you get stuck with any bugs so it's usually only used to boot to the real (rw) storage.