You can still provide a write-only bootloader interface (over UART or whatever) to allow for firmware updates.