There is the option 'Read-only field' for all configurable attribute fields. It is also applied even if a user is allowed to perform changes on the whole object (by being a member of a 'User Group Edit').
