You can set the .cmd file to be read-only (right-click > properties > read-only)
However, that is not very safe as the windows permission system is not exactly the best.

Idea

I would recommend checking the file, to see if it is unedited, before execution.
To do this you could hash the file, and compare it to your hash. As long as you hardcode that hash into your software, it will be difficult to reverse-engineer.

Implementation

Calculating the correct checksum

string CMDFileChecksum()
    using var md5 = MD5.Create();
    using var stream = File.OpenRead(PATH_TO_YOUR_CMD)

    var hash = md5.ComputeHash(stream); // Compute the hash
    return BitConverter.ToString(hash)
        .Replace("-", "").ToLowerInvariant(); // Convert the hash to a string
}

Checking file

Then you would need to run it once in order to get the correct hash. Copy the result and use it like this:

// Put your checksum as calculated by CMDFileChecksum() herer
const string correctChecksum = "CHECKSUM"; // Use const to bake the string into the code

if (correctChecksum == CMDFileChecksum())
{
    // Run the CMD file
}
else
{
    // The CMD file has been edited => throw error or warn user etc.
}

This will calculate the checksum of the file and compare it to the correct one. If the file has been modified, the file won’t be executed. If this occurs you could download the correct file from the server, warn the user not to do that, or whatever you want really.