I know how to repair disk permissions. But... Who broke them?
Many factors might come into mind. A process with root privileges is the main cause.

Think about an Application that you grant permissions to install using your Admin password. This Application might not have permissions set properly for certain folders that are installed in key OS location (i.e. /Library) would cause the permissions to change.

Think about a process in an Application that is granted a root privilege and does tamper with permissions in folders incorrectly.

The idea of locking the permissions is nice, but that would be implemented at this time with a no-write permission. Unless of course there is lock-permission-only flag is used; something I don't know if it exists.