As a plugin author, I'd like to be able to set certain provisioning templates to be read only, so I can supply originals and updates in my DB migrations and be sure that I won't lose a user's changes when they upgrade.

In the bootdisk plugin I do this by patching the config template model:
https://github.com/theforeman/foreman_bootdisk/blob/master/app/models/concerns/bootdisk/config_template_ext.rb

(this could probably be tidied and submitted to core)

I then supply the templates in DB migrations, including updates, then ask the user to copy the contents to a new template (#1646 would make this a lot easier) and to change a setting pointing to their customised template. If they then upgrade the plugin, the user can then merge the two by hand or switch the setting back to the one I supply.