Thanks for that, I missed it in TFA. But ouch, that feels like an extreme design choice. What's the logic here to erasing the flash on a failed checksum, or requiring a checksum in the first place? Is there a non-obvious security threat?
If a firmware update needs to alter the calibration data or other rather static config, and that update process is interrupted by an empty battery then it can't recover. It should of course be more conservative in killing all of the config section... Or could reset to some sane default. Or have a copy of the old known good data around and restart the procedure