An OS running on a hard drive can be equally unwritable, provided it's
properly designed and configured. Linux and the BSD's have the ability
(via the "immutable" bit) to make individual files or all of the files in
a directory unchangeable even by root. With a few additional machinations
you can make the files unalterable without rebooting the system off a
CD and changing the immutable bits from there. That in turn requires
having physical access to the machine.
Whether the kernel is on a HD or a PROM, you still have the problem of
users being able to configure hardware for their service provider, add
drivers for new peripherals and hardware, install and update the
applications they need, and so on. To be successful in the market you have
to allow users to customized their machines to do whatever they want them
to do. As soon as you allow this level of access, you have unskilled
people messing with system configuration and installing & configuring
potential malware. This is already the point of attack for most of the
malware that plagues us today. Further securing the kernel isn't going to
solve the major part of the problem.
What's badly needed is to make it easier for unskilled people to install,
upgrade, and configure applications and hardware without opening up
vulnerabilities. I'm not familiar enough with OS-X to comment on it,
but IMO Windows and Linux are both massive failures in this department.
By the way, here's a site you may find interesting:
http://www.linuxbios.org
LinuxBIOS is a Free Software project aimed at replacing the normal BIOS
with a little bit of hardware initialization and a compressed Linux
kernel that can be booted from a cold start. The project was started as
part of clustering research work in the Cluster Reseach Lab at the
Advanced Computing Laboratory at Los Alamos National Laboratory. The
primary motivation behind the project was the desire to have the
operating system gain control of a cluster node from power on. Other
beneficial consequences of using LinuxBIOS include needing only two
working motors to boot (cpu fan and power supply), fast boot times
(current fastest is 3 seconds), and freedom from proprietary (buggy)
BIOS code, to name a few. These secondary benefits are numerous and have
helped gain support from many vendors in both the high performance
computing as well as embedded computing markets.