if preinit could execute arbitrary code from one of the drives that doesn't get wiped on a .upgrade, then you could theoretically render your player unbootable in a way that .upgrade wouldn't fix?

No, because preinit will only be called by hijack kernels. It exists as the file /sbin/hijack, which hijack will try to execute in favor of /sbin/init. The default kernels won't do that. Hijack will fall back to /sbin/init if /sbin/hijack doesn't exist. Both kernels will then fall back to /sbin/sh if init doesn't exist; that's a standard feature of all(?) Unix kernels.