Sounds like a job for chattr +i, though who knows what will happen someday if a macOS installer script tries to modify it.