Contributors should not be allowed to change readonly fields, they cannot with the classic update method.
But I tested that if a user with contributor permissions uses a javascript / REST with ValideUpdatelistem, he/she is able to update a readonly field.
I find normal that a full control user can do it, but not a contributor.
I find no reason, the classic update method does not work, but yes using ValideUpdateListitem.
There are other ways not to include fields you don't want the user to fill, without making it readonly, and if you make it readonly and you need a contributor to fill it, you can always use a flow to update from an elevated privilege.