Having applied "paranoia mode"
and even special chflags immutable flags
and having nullfs loaded
It is possible to bind the files with
mount_nullfs to cover the existing config or binaries.
Not sure if this is a bug or feature...
just in case raising it.