So how do we protect write ups now?

I dont think there is a good answer yet - other than, for now , write ups are dead.

The admin password of the box is only an option for some boxes. Quite a few of them are rooted without ever finding it. Quite a few boxes are rooted by an exploit exposing the flag and nothing else. Take the retired box RE, for example, getting the admin password is basically getting the user flag. You never get the final password.

I get that this is a valid decision by HTB, who are keen to present rank/score as something with value but, for me, it does reduce the value & fun of HTB.