It isn't uncommon that you can have processors that uses multiple processors.

The main code may use an external processor crystal. This oscillator is used to generate 1ms and 1s interrupts etc for normal use.

The watchdog on the other hand may run from an internal RC oscillator.

If the main oscillator fails, the RC oscillator will continue to tick and reset the processor ecause the main program doesn't kick the watchdog.

The main program can, on the other hand, keep track of the RC oscillator. Either by reading some register to see that the timing registers are ticking, or by also dedicating a normal timer to the RC oscillator and have it generate a regular interrupt.

So the program can get a hardware reset from the watchdog if the main oscillator fails. And it can force a manual reset (maybe by drawing a GPIO pin to the external reset pin, or maybe through internal magic) if a software loop detects a failure with the secondary oscillator.

Obviously, a too long supply voltage that makes both oscillators fail is irrelevant - when you can't drive the oscillators because of bad voltage, you can't expect a watchdog to keep the program running either.

But in the end - two hardware watchdogs are a concept that is not really needed. The requirements for many certifications is that the watchdog must be independent on the main oscillator so a program that happens to turn off the power to the external oscillator - or maybe a hard knock makes the oscillator stop - must not also deactivate the watchdog function. The open issue is of course that a processor reset isn't the same as a cold power-on - for processors that has a reset-out pin, it doesn't hurt to look into solutions where an internal reset condition can be upgraded into a 1-second cut of the power to all electronics on the board.