When I have managed replicas, I always set this on the replica:
SET GLOBAL read_only=ON;
Of course the replication thread gets to ignore this. But it ensures that all user requests (even superuser requests) cannot make out-of-band changes.
A user with SUPER privilege can still write changes on the replica even if read_only is enabled. Don't grant SUPER privilege to users.
On MySQL, you can solve this with:
SET GLOBAL read_only=ON, super_read_only=ON
But a user with SUPER privilege could get around that because they can change the setting.
The larger problem is if you can't trust the users to whom you grant SUPER privilege.