Clone project at https://github.com/pzapata/kie-examples.git

Start process, notice that before starting a task, you can modify the Creation Date field, even if the form is displayed in read-only mode.

All the fields need to be verified they are following the read-only flag, both set at the form level or at the field level.

Subforms are also not following that convention, if you set a subform field with readonly, it's still possible to modify the content. It should propagate the read-only behaviour to the fields inside.