If a user uses the override functionality to modify a request, form fields which are set to "disabled" in the form editor can be editted.
Release: CASVCT99000-12.9-Service Catalog
This is expected behaviour. The ability to edit a field which is disabled is part of the override functionality. It is intended for administrators to be able to modify request details as required, or to approve a request where they aren't assigned the request pending action.