Malicious apps can hose Android phones, erase data
arstechnica.com
arstechnica.com
That attack is then annoying and might cause device wipes due to not knowing that option, but looks not that blocking then. Google might also filter that attack by looking for that in their Google Play app check routine.
When successfully started Android, you should be able to access it by long-pressing the power button to get into a popup menu, then long-tapping on the power off text button there. Also different hardware key combinations might work while booting.
Also, just speculative, Android itself might detect a boot loop or crashes while booting and then automatically restart into safe mode.