Something like fsverity could be a decent half solution. https://fedoraproject.org/wiki/Changes/FsVerityRPM

Of course you won't have that layer of isolation if something becomes compromised, but it should make it harder for malicious code to persist on your system without you knowing.