It’s immutable (aka. atomic), which means the system files cannot be changed, even by root.
This is a definite “well um actually” moment, but technically immutability can be switched off at any time with chattr, and “true” immutability will not be achieved until full image signing is commonplace. You can see the ideas laid out here: github.com/ostreedev/ostree/issues/2867