That’s a footgun sure but at least you can avoid it once you’re aware of the problem.
I never write function signatures with mutable interfaces. It’s always IEnumerable, IReadOnlyCollection, or IReadOnlyList; otherwise, use a concrete type. The latter is typical for private/protected methods that are called with instance members of a concrete type rather than public interfaces. If you want to mutate an object, you should own it. Public methods are invoked with data not owned by the instance.
For example, a lot of extension methods in LINQ have a signature IEnumerable<T> --> IEnumerable<T>, and internally the first thing they do is call .ToList(). The interface makes minimal assumptions about the input data, then puts it into a concrete type you can manipulate efficiently. You can similarly define a method for IReadOnlyList and explicitly make it mutable via .ToList(), rather than use IList and check .IsReadOnly. Both ensure correctness but the former does it at the type level, at design time, instead of relying on runtime checks.
C# is old and full of oldness. But it’s also an excellent language that can be written beautifully if you know how. And there’s lots of great code to learn from in the open-source dotnet core runtime repo and related projects.
What I described isn’t necessarily functional. This is just a principle for ensuring objects represent clear and well-defined contracts. The idea is that to mutate something, you should own it; that means interfaces / public APIs, which can be called externally, should take immutable arguments. You can still mutate instance members internally because those are owned by the instance. If mutation is really necessary between two objects then it should be coordinated by an object owning them both.