Steps to reproduce the issue

• Make sure you have two users with different user groups, both with edit access to articles
• As superuser, create a custom field of type "media". (This also applies to subforms, but it's easiest to test with media fields because it requires less set up.)
• • In the "options" tab, set "display when read only" to "yes"
• • In the "permissions" tab, set the edit permissions for your other user to denied.
• Login as the other user and navigate to the edit form where the custom media field is visible.

Expected result

Media field is visible but cannot be edited. Fields for media select, alt text, etc are disabled.

Actual result

Media or subform field is visible AND can be edited, or it appears to be editable. Fields can be changed and text can be entered. Changes will not be saved to the database, but it is misleading to have the fields enabled.

System information (as much as possible)

J4.1.5
PHP 8.0.8

Additional comments

In the case of subform fields, you can set individual fields part of the subform as read-only and the fields will be appropriately disabled.

However, imo the permissions for the parent subform field should override that because individual fields can be used in multiple subforms which may have different permissions.

This also applies to media fields presumably because they display as their own tiny subform with multiple fields.