Do bear in mind that 'read-only' access is not totally read-only - a read-only account still allows port-cycling and cable-test operations to be performed on switch ports.
For instance, cycling a port will result in downstream devices will losing connectivity and PoE.
We had a customer find this out the hard way.
I.e. you still need to be careful about granting read-only permission and caution users about these operations.