Famous example of a watchdog saving the day: Mars Pathfinder. It's hard to send someone to hit the reset button on a device that's located on another planet.

However, even if software and hardware were perfect and both bug-free, they'd still be operating in the less-than-perfect real world. There are external events that you cannot shield your device from (cosmic rays, radioactive decay of the atoms inside your shielding, etc.), or the amount of shielding required for complete immunity would conflict with the requirements specification - i.e. the device would be immune to the external event, but the shielding would keep it from performing its intended function.

In the end, it's a matter of statistics. If the watchdog solves more problems than it causes (i.e. by turning unsafe failures into safe failures, or by restoring normal operation after an otherwise unrecoverable failure), use it, otherwise leave it out.