I discovered that if IIS7 founds a web.config with this content:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <handlers accessPolicy="Read" />
    </system.webServer>
</configuration>
 

it will disable the script execution in that folder.

That could make new installations more secure.

app_data will continue to be writable

it's just removing the execute and script permissions as you wrote here http://www.mojoportal.com/securing-the-file-system.aspx