As of Big Sur it's impossible. The entire OS is now a single cryptographically signed image that's verified on boot, which is great for security but it includes some things that don't particularly need to be locked down.