[dspillett]

You usually don't, unless you demand signed kernels and have a secure method of blocking unsigned ones.

But the read-only filesystem issue is something that could happen by accident rather than malicious alteration - for instance some filesystem errors may result in it being mounted RO for safety until the corruption is addressed.