I have a carefully created .zshrc, in which I don't want to have anything that I have not added there manually. Is it possible that some program, installer, or command will add some lines there automatically? (That is, at very beginning or at the very end?)
In other words, I do understand that echo foo > ~/.zshrc will modify it, but are there other similar scenarios?
It certainly is possible: any program you run has the permission to modify your .zshrc. But in practice, of course, most programs won't do it.
Installers and configurations directly related to zsh are likely to modify .zshrc, e.g. the installer for oh-my-zsh. This is pretty well justified: you're asking for it.
Some installers for software that come in the form of a shell script and are intended to be used on a user account modify the user's .bashrc or .zshrc. They do it to set up shell completions, PATH entries, aliases, functions, etc. This is not always justified, and what they do isn't always compatible with your configuration. PATH in particular shouldn't live in .zshrc (any more than .bashrc), but that mess is here to stay. Completions and functions are somewhat justified because there isn't a standard fpath entry under the user's home directory.
In practice, I've seen that with installers for development environments, such as opam init (which asks for confirmation) or nvm's install.sh (which is just rude about it).
To keep track of what you've done manually, one possibility is to make ~/.zshrc a very small file that just sources another file, e.g.
source ~/etc/zshrc
Then if everything else ever appears in ~/.zshrc, you know that it's been added automatically.
Another approach is to keep your .zshrc under version control. Then git diff or the like will reveal uncommitted changes.
You can combine the two approaches.
By default, there is nothing preventing applications from modifying your account config files.
If this is really a big issue, I suggest copying your config files to a directory, checking everything into git, and symlinking them back to where they belong.
That way, if something does modify them, you can quickly see what was changed (git diff) and just as quickly accept it or revert it.
Alternately, you could try chmod gou-w ~/.zshrc and naive applications that try to make changes will fail, but it is still possible.
Similarly, if this is super critical and you have root access, you can change the permissions so even you can't change it. You could do this with chattr +i to make it immutable (if supported) or just change the ownership (chown root .zshrc) but some things might be unhappy with you not owning your own config files, and it can still be renamed.
To complete the other answers, I can give you at least one concrete example: the installation of Anaconda will modify your shell config if you use the default setup. In this answer you can see a code snippet of what is added.
