External W25Q32 SPI memory flash for ATMega328

The magic is not in the bootloader, but in using a second chip. The Atmega328 can't reprogram itself.
You can replace the Attiny with another Atmega328 or anything else capable of reading the flash and reprogramming the first Atmega328.
Also, If your modules use common variables to "talk" to each-other, you will need a way to preserve these values.