Is using the CH340G on a commercial product a horrible idea?
The simplest option, and the one I'd recommend here, would be to use a microcontroller which supports USB natively and can be programmed with a USB DFU (Device Firmware Update) bootloader. One example of such a microcontroller is the ATmega32U4, as seen on the Arduino Leonardo; another is the ST STM32F103. Even if these microcontrollers are a bit more expensive than the one you would have used otherwise, the increase in cost is probably less than the cost of a discrete USB UART interface. Using a single part will also reduce the overall size and power consumption of your device.