Can I make a PRNG that is secure even when state can be modified by user?
This is not secure.  There is a distinguishing attack that involves about $2^{41}$ invocations of the interface.

Define $f(x) = \text{MSB}_{80}(x) \oplus \text{LSB}_{80}(x)$.  Consider applying the following operation, which I'll call "Leap":


Call Read.  Call the result $d$.
Call Update $(0 \, || \, d)$ (i.e., call Update passing the 160-bit value obtained by concatenating 80 zero bits followed by $d$).


Notice that if $s$ is the state before a Leap operation and $s'$ is the state afterwards, then $f(s)=f(s')$.

The attack will involve applying the Leap operation about $2^{40}$ times.  If you examine the internal state $s_i$ after the $i$th Leap operation, it will satisfy $f(s_i)=c$, where $c$ is some constant that is the same for all of them (in fact, $c=f(k)$, where $k$ is the initial state).

Thus, each $s_i$ comes from a space of $2^{80}$ possibilities, and each $s_i$ is basically a random element from that space.  Now by the birthday paradox, once you have $2^{40}$ randomly chosen elements from a universe of size $2^{80}$, there is a pretty good chance that some pair of those elements will be the same.  This means we expect to find some indices $i,j$ such that $s_i=s_j$, i.e., where the state after the $i$th Leap operation is the same as the state after the $j$th Leap operation.

But of course the behavior of the PRNG is a deterministic function of the state.  Therefore, the behavior of the PRNG at time $i+t$ will be the same as the behavior at time $j+t$.  In particular, the sequence of outputs at times $j,j+1,j+2,\dots$ will be a repeat of the sequence of outputs at times $i,i+1,i+2,\dots$.

In other words, if you perform a bunch of Leap operations, the PRNG will enter a cycle and start repeating after about $2^{40}$ steps.  This is too fast.  It's something that a true-random generator would not exhibit.  It allows to distinguish the output of the PRNG from truly random, and to predict future outputs (assuming we continue to apply Leap operations).

By academic standards, this would count as a break of the PRNG, since $2^{40}$ operations is feasible.  By practical standards, it might not be an enormous risk, because it requires that the adversary has a way to alternate Read and Update operations and that the adversary has total control over all of the Update operations -- but it's still a break, by the standards that cryptographers use.

A possible fix would be to change your Update operation to

$$s \gets H(s,v).$$