Check access for on_change
The code of the on_change* are run under the _check_access=True context. This means that the code can not access data that the user would not have access.
I think the control should be done only for the read access of the field values sent by the client. And after this check, the code of the on_change* methods should be run without _check_access context.