I am aware the Iphone had three levels of software:

Bootloader
Baseband
Firmware.

If I have an OTB 1.1.1 is it possible that a future update could update the bootloader or is that set in stone?

Highly unlikely. You see, if you flash the baseband/bootloader incorrectly, the phone will no longer boot up. No company would risk that.

And you know lots of users would be dumb enough to brick their phones. Apple would face some *serious* backlash.

Cool. Then as I have 3.9 .....

I purposely brought another for family at 3.9 as I see that as the way forward rather than waiting for successive secpacks..

Actually, the best known company to take exactly that risk is... Microsoft
And about every network provider out there offering updates for WM5/6 cellphones (they were cooking their own ROMs for their customers, generic Microsoft ones couldn't be installed on any device without tricks), which for example happened for nearly all WM6 updates for devices like the HTC TyTN (aka Hermes, Mercury, ...).

It's been some time I've been cooking my own WM6 ROM, but if I remember that correctly, the standard updates always included "SPL" (bootloader here) and "radio" (baseband here) in addition to the main OS part.

To avoid bricking through improper SPL/bootloader flashing, there was an inofficial "HardSPL" update (patched bootloader) that prevented itself from being accidently overwritten by such an update, but the official ROMs all took that risk. For millions of HTC devices out there.

and don't forget the BIOS update your pc maker pushes to you