Here's an update: the software write protection bits were not the whole problem; after installing some fairly large packages, the filesystem errors started again.
I have now built a new kernel which omits the SECT_4K flag for the sp25l128[05d,35e] entry in
spi-nor/macronix.c, and this seems to improve things; sysupgrade works (at least on a device that was not yet showing filesystem errors) and I was able to install some large packages without developing errors. There was some mikrotik discussion that inspired trying that.
This is using 22.03.2, with everything standard except the tweaks in macronix.c (so kernel 5.10.146)
Have to wait a while to see if that actually fixes things, I guess.