Permission attributes for variable sets, library variable sets, or even variable
Add RO attribute/flag to variable set to prevent accidentally changes of it. Or even develop extended permissions linked to username, groups etc. For example in our Octopus environment we have default variable set in library for special package and I'm afraid if somebody will change it accidentally and it will affect to whole related projects where it will be used
Another solution would be to be able to scope Variable Sets to projects so that they could only be used by those projects and view by anyone having VariableView on any of those project. For example you have a variable set containing login and password used by a group of projects and don't want those to be used by other projects.