There are at least 2 AVR Forths that do write to flash to add code and data to their dictionaries.
What about bootloaders?
amforth overwrites them, they are no longer existent. And this can only be changed for bootloaders with an application usable API to use the flash self programming feature. There are none currently available. With such an API the only word thats need to be rewritten is i!.
I looks to me that we might be able to write to flash at runtime if we use a bootloader that has functions to do so. At least from what I have read code in one part can call routines in the other that is capable of doing such writes.
A device with such capability might be distro'd to people who put their own info there to do whatever the device does with such data. Instead of thinking all the things you shouldn't do and 'just saying no', what about the things reasonable that may deserve a 'yes'? An open approach instead of closed?