Can I prevent users from deleting attachments?

By default, attachments take their edit rights from their parent object. Thus, if an object record is read-only, without customization, attachments should be read-only as well.

Keep in mind that an attachment is considered to be a normalized field on an object, so if users can update the object (as in, update any field), then they can also update the attachments on the object.