This prevents users from disabling background items in the system settings. However, they can still run launchd unload in terminal or delete the files.

I even tried adding ALL ALL= (ALL) !/bin/launchctl to the sudoers file, which prevents admins from running launchctl unload. However, non-admins are still able to run it.