"That would apply equally wheher the puppy was internal or external"

I disagree. If the watchdog is external, you have the choice of arranging things so that the watchdog cannot be disabled.

All of the derivatives I've used with internal watchdogs (none of which have been selected with the intention of using the internal watchdog) have a single SFR bit that can be cleared at any time to disable the watchdog. I believe this is a pretty common 'feature'.