Profile Form Allows User To Change Field Even Though Disabled

I have added several fields to the Profile Form. Some I have set to allow the user to change the field and some they can not. When I login as user when I try to change fields that are set for users not to change they work as expected which is great.

I have a problem with any field where I have set a file upload though. Even though it is set to not allow the user to change it they can still upload a new file. I can’t figure out why this is happening when other fields I’ve configured the same way work the way they are supposed to.

How can I fix this? Is it a bug?

Thanks!