Peter,
all you said is correct if we talk about "ideal" MCU. In practice, there are alot of additional problems. For example, some vendors publish Errata which I cannot read without tears. Let post the one of them:
16. EEPROM – Lock-up during ISP write.
[skip]
This problem is technology dependant. The likelyhood of experiencing the problem is low at Clock frequency > 24 MHz in X1 mode and nulle below.
A reset can be appliyed to recover from the lock-up.

So I cannot say that external watchdog is not needed for permanent power ON systems, especially when it is integrated into Power supervisor chip which is needed anyway. I think high stability of such systems is much more important than their cost, yeah?

Regards,
Oleg