[tesseract]

Cost (reputational as well as CSR hours and the actual replacement units) of a bunch of warranty claims for bricked units is a factor too.

In practice pretty much every embedded device I've worked on that has supported in-field firmware updates has had either double buffering and/or a recovery mode to limit the possibility of bricking.

For the products where every last penny really needs to get squeezed out of the BOM (toys, low-end appliances, ...) the ability to do in-field firmware upgrades itself is IME often one of the first things to go.