Unpowered ATmega in a powered circuit
If you use a brownout detection function (properly configured and specified) you should be able to prevent that.
As always, the devil is in the details and you will have to examine all the tolerances and limits to assure that it will work under all conditions. One number that may be difficult to find is the minimum voltage at which an external non-volatile memory can be written to, if the MCU decides to get into some mischief. In other words the reset must be reliably asserted below that voltage level (perhaps 1V-ish). Sometimes you have to compromise clock speed in order to guarantee the MCU will operate properly at the minimum voltage the brown-out can release, when all tolerances are taken into account.
Some MCUs advertise a brownout function but it's effectively useless at popular supply voltages such as 3.3V because of the way the nominal thresholds and tolerances work out, so it's necessary to use an external circuit.
If the circuitry is inadequate there's a chance every time the power is cycled for there to be an issue. Cycling it constantly increases the odds in a given period of time. Often rump power cycling is worse than cleaning turning it on and off.
You should have a proper reset circuit, always, but personally I'd likely also add circuitry such as transistors or a voltage translator with the same Vdd on each side to prevent that from happening at all.