There is CONFIG_STATIC_USERMODEHELPER that disables the sysctl you mentioned and actually make modprobe_path read-only.