Bottom line: Most likely you have the dreaded Ransomware Protection on and Rack being added to the exclusion list on install of later version might not reset the read-only flags on document directories. Could also be some 3rd party anti-virus you’re using - get rid of that!