Those are often files not directories. In that case I zero out the file (no bytes) then change ownership to root and -w it. Ridiculous you have to jump through these hoops to manage your own machine and Apple doesn’t bother to expose this anywhere.
Clearly though, an irresponsible or rogue app could later install a "warez version" of itself after the user had installed the harmless one. And MacOS appears not to put up any gaurdrails to prevent that.