modprobe by name still works, even if the module is blacklisted, and so does insmod and the syscalls they use.

Agreed. There is a way but I would never recommend it to anyone. Showing just for completeness sake in the event anyone else suggests it but do not do this and certainly never put it in a config file or "bad things will happen ©2009-2026".

    # rmmod the module of concern first, then if that exits with the correct exit code:
    sysctl -w kernel.modules_disabled = 1
    sysctl -w kernel.kexec_load_disabled = 1