> Part of this bootloader is, that it may update itself remotely
Why ?
The incentive for a (second-stage) bootloader is the capability to update device software in the field. A bootloader update is only necessary for critical bugs. My company uses such bootloaders in about half a dozen different ECU devices in heavy machinery, and none of them is designed to update itself.
This "self-update" very much complicates the design. The bootloader, or crucial parts of it, must be relocated to RAM at runtime, since it cannot erase/program the section it runs from. Most MCUs cannot run any code from Flash while an erase program is ongoing (depending on bank design).
Rather do proper tests, considering all probable scenarios.
