Be interesting if there is a rad hard watchdog. Maybe you could end up having standard off the self parts and then use a reliable watchdog to intervene as needed.
Especially if such watchdog has the ability to switch to a secondary or third backup...
edit: Shoutout to wildzzz for pointing out ISL706ARH
Active Rad-Hard, 5.0V/3.3V µ-Processor Supervisory Circuits
Right, having a second chip functioning as a watchdog which doesn't share the same silicon substrate mitigates the latchup. If you can recover before both theoretically could get struck, statistically you'll be okay. For added safety, have an extra one that is not coplanar with the other two so a single heavy ion strike can't pass through all 3 chips.
Especially if such watchdog has the ability to switch to a secondary or third backup...
edit: Shoutout to wildzzz for pointing out ISL706ARH Active Rad-Hard, 5.0V/3.3V µ-Processor Supervisory Circuits