The double-tap restart (write one byte pattern then write another) internal watchdog timers make a runaway software restart extremely, highly unlikely by any code other than the restart lines itself.

I think internal watchdog-timers are preferable WITH THAT enhancement to external watchdog timers. However, sometimes you need something to reset external circuitry though the micro SHOULD have the reach to do that.

I still prefer external microprocessor supervisory chips to clean up reset, and issue power brown-out resets.

duh