In a large and complicated system, especially a system with many interrupts, it is possible that the background code (or your main() function) simply can't service the WDT often enought or the interrupt(s) response time can exceed a WDT's limit
--------------------------------
in this case shouldn't the watchdog period
include these delays?
i agree that there is a
certain unpredictability in external events
and it may not be possible to account exactly.keeping ISR's short would be helpful.

servicing WD in ISR will not give any idea whether the code has hung up.it simply tells you that your code has not disabled timer interrupt accidentally.also it can't tell you if it has accidenetally loaded a wrong timer value.
reagrds
pranav