I think you overstated the security aspect of read-only filesystems. Even if you set it to read-only at the block device level, it won't stop a rootkit or kernel exploit from writing to the drive. Some USB drives, SD cards, and occasionally hard drives, claim to support device level read-only mode, but even then, they almost all have writable firmware that could be maliciously modified by software on the host (see BadUSB). The only consumer hardware I know of that supports anything close to physical write protection is the CD-ROM, and even most CD-ROM drives keep their firmware on a writable flash chip. 

Most of these are advanced attacks that average person will ever have to worry about, but worth keeping in mind. Read-only root filesystems are mainly meant for resilience against power failures and simple unprivileged malware, but it's not meant to provide any true security against sophisticated attacks. That's why we have UEFI SecureBoot.