API host.update allows changing values that should be read-only according to https://www.zabbix.com/documentation/7.4/en/manual/api/reference/host/object.

For example the flags value can be changed making the host record invalid:

Result on 6.0 (but this also affects master):