Stopping/disabling a service should be a command, like it is on Windows or Linux. Not configured on a read-only volume bundled with other security guarantees.

It's pretty simple to keep these two things separate, like everywhere else in the present and history of the industry.