The syspref SubfieldsToAllowForRestrictedEditing is not taken into account and all subfields are editable.
Nevermind, the permission is actually working reverse. All good!