I guesss I shall answer your second question first.

In a large and complicated system, especially a system with many interrupts, it is possible that the background code (or your main() function) simply can't service the WDT often enought or the interrupt(s) response time can exceed a WDT's limit. One common technique is to use a counter that increments in the background every time when the WDT is serviced. The foreground code or the ISR will only service the WDT when this counter differs from its previous value. In other words, if the background code for some reason stops servicing WDT, the foreground code will stop as well.

This is far from a "perfect design" (as we all know the Murphy's Law applies :) ), but perhaps this can be the best trade-off in time.