As you know that Users with edit permission on List can edit List Item via CSOM or Rest API. It does not matter if the data is simple, but in case the data of list item is essential and stored with a format, it will absolutely not secure at all.
It can be done by setting Read permission for this list and use Administrator Privilege when performing create and update list item. However, if doing so, we will have to rely on SOM that I do not like much.
I also think about Audit log for list Item level, but I am not sure about whether or not we can recover list item in case data is edited deliberately.
I would like to know your idea or experience in such situation.