Brickable?

Whether or not you need twice as much flash depends on how capable the factory image is. If
the factory image is just a bootloader, and pretty dang generic, you can do it with a small
amount of ROM. In fact, the AT91SAM7 series does that whole thing on chip (it's got a USB
bootloader in the chip's ROM, and if you assert the "erase" pin, it clears the flash and runs
that bootloader). If the USB and that pin are accessible, you pretty much can't brick it
except by damaging the chips.

It doesn't really work if you want a locked-down device, since the bootloader won't enforce
signed-image requirements, and it wouldn't work for users who want their hardware to route
packets out of the box, but it'd be fine for this sort of device.