Power supply rails shouldn't glitch, and a decent system will either work correctly through a brownout, or reset/restart properly if it can't.
We (me and my guys) have had this discussion, about whether we should try to anticipate/sense/fix states that "can't happen", in the sense that there's no logical path to the bad state. Our concensus is that such sensing/fixing is fruitless, since any non-trivial system has astronomically more hazardous states (like the enormous state space of a uP program and its variables, or the megabits of configuration ram in an FPGA) than can even be analyzed, much less repaired. If a counter botches its state sequence, find out why and fix it. If a uP program crashes, ditto. And don't design asynchronous state machines that have small, lurking probabilities of screwing up. Things like watchdog timers hide the design errors, so you neither fix things nor learn.
Because it may fix a system hangup caused by who-knows-what, things that analysis and a few months of running didn't reveal, huge ESD shots or something.
I've never seen a watchdog timer cause a problem by malfunctioning on its own. I did recently code a diagnostic routine that, given a request to take and average zero ADC samples, would divide by zero, hang, and trip the watchdog. I found the bug after some units had been shipped, by reading the code, and as far as I know the bug was never tripped. Cases like that justify enabling a watchdog *after* considerable testing has not found provokable bugs that might trip it.
When my opinions differ from yours, you like to explain it by conjecturing some sort of emotional crisis on my part. Do you treat everybody that way?
John