This appears to be a bug when having form attributes being configured as read-only and also be available in the BPF. If the attribute is statically configured as read-only, this state will not be reflected in the BPF Ribbon. You can update the read-only attribute from the BPF Ribbon, it will be updated in the form and the new value will be saved.
If you have the read-only state being updated dynamically using Business Rules, this will only be reflected in the BPF Ribbon in a specific situation. If the Business Rule is applied to the form attributes while the related BPF attributes are in the active BPF stage, the BPF attributes will be updated to read-only as well. But if the Business Rule is applied to form attributes while the related BPF attributes are not in the active BPF stage, these BPF attributes remain editable. And will also update the related read-only form attribute and the new value will also be saved.
This will of course require quite a few work around solutions to ensure the integrity of the configured Business Process Flow.