@tobihagemann just pointed out to me, that probably Cryptomator tests for write access on every unlock (and if storage is read-only, adjust the virtual filesystem). I looked into the code, yeah that is the case.
To conclude:
Cryptomator creates on every successful unlock a temporary directory called write-accessXXX and deletes it afterwards.