composer require fails because it can't delete default.services.yml
Make your &quot;local&quot; machine work as intended, and maintain the security of your live site.
Since you want to use composer require command only on non-production environments, the following steps affect only on the machines you deliberately set up. Drupal's recommended configuration will be preserved on all other machines, including production servers.
Don't make this change to settings.php to avoid having it on PROD or propagating it silently to other developers' machines.
Steps

enable settings.local.php (here are the instructions from the docblock in settings.local.php):

 * To activate this feature, copy and rename it such that its path plus
 * filename is 'sites/default/settings.local.php'. Then, go to the bottom of
 * 'sites/default/settings.php' and uncomment the commented lines that mention
 * 'settings.local.php'.
 *
 * If you are using a site name in the path [... read about exceptions in file]


set file permissions to allow user and group to write to the file on your local machine:
$ chmod ug+w {name_of_docroot}/sites/default



How this approach matches up with the established community approach
By default, settings.local.php contains the following line:
$settings['skip_permissions_hardening'] = TRUE;

This line tells Drupal to avoid resetting permissions on the default folder only on your local, and allows you to work more smoothly with composer on your local without weakening permissions on any other copy of the codebase.