> I usually do chflags schg instead of chmod 000.

Thank you. This was the best tip to come out of this whole discussion.

I'll identify every location Google apps write to, and lock them out with this.