<filesystem><readonly/><filesystem> does not work for virtiofs
Specifying <readonly/>
for a virtiofs filesystem does not work. It simply gets ignored, possibly leading to a false sense of security. It seems that there is no qemu support for read-only virtiofs devices.