As vault is supposed to be on inexpensive media (probably cheap SATA array)
it would not be advised to work on data stored there

So it would be nice to have an option to make the destination read only

Sure I can do that later with JRB Utilities, but that an extra step