LiveCDs had the very nice property that you could be fairly confident you weren’t going to get any viruses when you inserted them into a stranger’s CD reader slot. You were less confident inserting your home burnt media into a strangers CD writer slot, but still reasonably confident.
LiveUSBs however have supplanted LiveCDs and provide no confidence. Putting your dongle into a stranger’s universal bus is a great way to spread electronic disease.
Aside from viruses, it was nice to have backups be read-only too.
Some USB drives have a read only mode, but I have yet to find one that was affordable.
The read only switch on SD cards as I understand it is more of a suggestion than a rule.
I suspect CD/BR is the best option still, but I feel a bit anachronist adding an optical drive to a computer today! Five and a quarter bays are an endangered species. USB optical drives exist but haven’t been the most robust devices for me.
I had this problem when I was still in the university - every time you put a flash drive in universities pc, the god of gifts would smile upon you with a fresh batch of viruses.
Although this was back in 2010s, but I solved that problem basically by restricting RW accesses to the root directory of the drive, while making full write on specific folders. Viruses needed the root of the disk to go further, so they stopped there, while I could see and access the folders from a random pc.
The IODD drive-emulator devices can present ISO files as if they were USB CD/DVD/BD drives, and they can expose .img files as USB hard drives. I believe they also have an option to expose hard drive images as read-only.
I keep my IODD Mini in CD-only mode most of the time, and choose to expose the hard drive only when I want to add a new ISO.
Note that they have two versions of the firmware: one for fat32, one for NTFS. I think they can also be picky about partitioning.
I do not vouch for these products as I have not used them. Not sure if the hardware encryption uses a standards-compliant interface or something proprietary.