So I mark as invalid.

I agree that should invalidate it. The way to improve it is by implementing issue4207

For me, it is not a security issue because it is a behavior (or more an "non-behavior") that is known with issue4207.
There are many places in modules where specific code is written to enforce a kind of "readonly".
Also the field access already exists if someone wants to restrict it.

Side note, it is not linked to sao at all because it is not the client that should enforce the access rights.

So I'm in favor of invalidating this issue.

Steps to reproduce

I create a party as the screenshot https://pasteboard.co/HdfGj0t.png
I remove readonly attribute on field (implemented readonly on states) from html https://pasteboard.co/HdfGvxQ.png
I change the code party and save change https://pasteboard.co/HdfGE0Y.png
Treeview after save change https://pasteboard.co/HdfGTcY.png

Someone with some technical knowledge on html can remove readonly attribute and bypass restrictions model when we use dynamic states.