OK, if I were designing pacemakers, I would check the ROM checksum. In other cases, the darn thang will fail in some other way and checking the program memory against the .hex file is the first test. Failing the system on checksum error at startup will just create a failure mode that saves the above step.

Erik