Is your feature request related to a problem? Please describe.
Currently, by default, it is possible to write on the root filesystem

Describe the solution you'd like
Specify readOnlyRootFilesystem: true as a default for all the containers in the manifests of the next release

Describe alternatives you've considered
Patch manually

Additional context
It seems that there is intent for the binaries to not write anywhere, judging from #2884 (comment) and #2883 (comment), although this might not be the case according to #5580.

Either way, whether a volume has to be mounted or not, I think it would be a good default to have in regards to security.

/kind feature