Actually, since posting (isn't that always how it goes), I've been thinking something like this might be involved:

Setting up a loop-device, as read-only, referring to the original partition, and then exporting the loop device.

It is true that the external machine (Windoze, typically) would not understand that the partition is read-only, but I'm more concerned with protecting my data (on the N9), than not confusing the external machine.

But where to put the script that calls losetup ? Somewhere in /etc/init ? I haven't yet had time to experiment with this. Is it even allowed (my N9 is not jailbroken/incepted in any way, and I'm conservative that way) to put ones own scripts in /etc/init ?