I tackle it pretty contrary to how everyone else seems to want to do it. I have the same "four levels" of Poison you do. Burn as well. I simply design around the "overpowered" nature of such things. Or, plan for players to actually be able to kill a boss like that. Because... what is the sense in ANY state if it can't be applied to a boss?
After all, random mooks die too quickly for a state to be useful on them... and bosses are the only thing you'd ever want to use a state on... but if they're too weak, you won't use them on a boss anyway as it's a waste of an action in combat.
For that reason, my states are powerful against bosses. Though, most bosses have "immunity" to most states. There's roughly 2 or 3 states they're not immune to (I have a LOT of states). Or at least... the higher level versions of my states are powerful against bosses.
But, they're even worse against the player.
Poison L1 - 2% HP reduction each turn. Lasts 3-5 turns.
Poison L2 - 5% HP reduction each turn. Lasts 5-8 turns.
Poison L3 - 10% HP reduction each turn. Lasts 8-12 turns.
Poison L4 - 20% HP reduction each turn. Lasts 12-15 turns.
They can stack as well. You can have Poison L1 through Poison L4 all on the boss or a character at the same time.
So, obviously, inflicting Poison L1 or L2 on a boss, for early in the game, is equivalent to getting extra hits on them (as if you were just bashing Attack, after all, when you're doing 4-8 damage a turn, and Poison does 2 or 5 damage a turn... pretty powerful). Poison L3 guarantees a fight doesn't last longer than 10 turns with a boss. Poison L4 guarantees the fight doesn't last longer than 5 turns with a boss. VERY powerful. Yes? YES!
But why? Because my bosses can do interesting things with the states. If I let you inflict Level 4 Poison on a boss, you can bet there are some mechanics the boss can use as counter-play. Maybe he can cure it. Maybe he can regen his HP. Maybe, his attacks become more powerful while he's Poisoned. If he dies in 5 turns, it's likely he's going to try to kill you in those 5 turns even more quickly. I have other bosses, that if you hit them with a version of a state, they can "retaliate" against it and use the same state (or a higher level of it) on you.
All of this, to make the choice to inflict a state on an enemy... a valid one. Equally as valid as using your strongest skills. Evolving your skills into inflicting higher levels of states at higher percentages isn't a wasted option. It's a valid way to play.
With all of that being said... Yeah, there are going to be some bosses you can just take out quickly and easily with Level 4 Poison. Because... why not? If the player doesn't exploit this weakness and instead fights the boss the long way... Oh well. However, it is doubtful a player will try every single state on every single boss just to try to find one that messes them up. If they know they are immune to all states except two or three... That means they are immune to about 7 or 8 other states. Do you want to spend that many turns to find the weakness? You can if you like (I suspect some players will reset to get this bonus on the boss, by trying everything, then reloading and doing what the weakness is on the first turn), but I doubt many players will care so much. It is likely that they might try a state every turn they're in combat if they'd decided that States are the way to evolve some of their skills. But, if they didn't decide to do that... Then, it's a 1 in 5 chance of inflicting a desirable state to steamroll my boss. Provided the boss has no counter to it, or interesting gameplay mechanic associated with it.
My states are merely an option.
And hey, sometimes... you just gotta reward the clever player who finds a way to "cheese" your boss without whittling them down with skills and attacks. It's about making combat feel good and tactical and rewarding good decisions. It's less about treating the player as an enemy to "give a challenge to".
After all, we're essentially DM's. If we really want to kill the player or make all combat a slog, it isn't hard to do. Rocks fall, everyone dies. Monster has very high unreasonable defense and immunity to every state and element. Giving the player a challenge isn't the inherently fun part for players. Solving the challenge or finding a way around that challenge is often the fun part. Rewarding clever thinking.