I don't mind too much if the watchdog fails if the watchdog clock stops.

But that requires that the watchdog has a separate clock from the main clock. And that a broken application can't deactivate the watchdog (or watchdog clock).

And that the watchdog can reset the processor if the processor stops kicking.

And that the processor can detect if the watchdog clock doesn't work (a watchdog run from internal RC oscillator would often allow a timer or similar to also run from same oscillator) and force a reset.

If the two can't independently detect a clock failure, or the processor can deactivate the watchdog, then the watchdog can't really be considered a watchdog.

As much of the eletronics as possible should be possible to test - or should be designed so that you can basically assume that it can't fail with less than a lightning strike frying the electronics into a "doesn't matter anymore" state.