A user with a read-only security profile has access to functions not expected of a Read-Only user.
This user may not have a Read-Only License Type.
Verify to see what License Type is assigned to the user. It is important to note the differences between a License Type and a Security Profile. Assigning the Security Profile with Read-Only User to a License Type of Full User does not block access to functionality that might be expected.
Vault Help Documentation: About License Types & Security Profiles
Send us your feedback: We're always looking for advice to help improve our Knowledge Base! Please let us know if this article was helpful or provide feedback on how we can improve your experience here.