With the default ext4 filesystem, mounting 'ro' doesn't actually prevent writes to the disk. For that you need 'noload' too, to prevent journal replay. This can result in a broken filesystem if it wasn't unmounted cleanly, although assuming it's 100% read-only it shouldn't do any permanent damage (perhaps enforce read-only access at the block device level to be sure).