I think it is a good idea to protect the base repositories, but it is not clear-cut.

Secondly third parties should try to parallel-install any package instead of replacing the core-supplied one. (or work with Fedora in such a way that instead of replacing a package all they need to do is provide a plugin...). I can see this is probably not always possible, and am certain 3rd parties would already have thought of this... so I may just be wasting space here.

What if 3rd parties start shipping their repo files with the protection enabled aswell? would that be of benefit, or would it lose the benefits of such a system?