Marketing should make that a feature: hardware-guaranteed non-modifiable root filesystem! Better than Nix!

No updates! Ever!

Also, no malware!

There used to be a PCI module (iirc) that would assist in that. I believe it was called a Bo(u)rne Again module. It was used in school computers etc.

There was an IDE dongle which did this. It was at a school I was visiting (but not my regular school) and it was pretty cool because it allowed them to be pretty liberal with permissions on the computers since you couldn't really do anything terrible as a reboot would fix everything and they powered them off every night.

There was (is?) a software solution called Deep Freeze. They used it on computers at school when I was growing up.