I worked on a product that had a total of seven MCU's in it. The design we did included a two wire serial bus implemented as RS485 that went multi-dropped to each MCU board and terminated at the TxD and RxD lines of each of the MCU's UARTs.
Each MCU was programmed with a boot loader that would respond to RS485 traffic that could support re-programming the "application code" FLASH of the MCU. Entry into the boot loader mode at power up was controlled by the analog voltage on a certain A/D input. Under normal system operation the pin would read near GND. Something between 2.5 and 4V would be seen as a "calibration mode" whilst an A/D reading over 4.5V was used to signal the boot loader mode. The A/D inputs were biased via a voltage divider so that the externally applied voltage on the CAL/BOOT wire externally had to be over 20V to get into the boot loader mode. This analog signal wire was also bussed to all seven of the MCUs.
An external PC was equipped with a special firmware update utility that could control the CAL/BOOT signal and then sequentially interact with each MCU over the RS485 comm link to perform the software updates. That same computer was also setup with a specialty calibration utility that used the same RS485 comm link to perform calibration and performance data logging for the product.
Note that since all MCUs were the same chip family from the manufacturer the same exact boot loader code was used in all of the MCUs. The MCU's were preloaded with the boot loaders by a programming service at the electronics distributor. The product application code was loaded into each MCU at initial board level test to save time over having to do it at product level functional test. Any subsequent update was done to the product level package without having to open anything up.
One last comment is that each MCU in this family of controllers could be in-circuit programmed via a SPI type interface. We provided pads on each circuit board that could be accessed via pogo pins on a board fixture that gave access to this interface. Through that it was possible to re-program the completed FLASH of the MCU including its boot loader. Once the seven MCUs were in place in the full product this access mode was no longer available because all the electronics boards were potted.