> I guess that, even with these checks, the program will still have some watchdog timer, a way to remotely reset it, and a way to upload new software, just in case it runs wild.

Indeed.

As for the reasoning: couldn't have said it better myself.