I set EnableSessionState to ‘ReadOnly’, but in InProc mode I can still modify the session. Why is that?

Even those enableSessionState is marked as ReadOnly, but in InProc state, the user can still modify the session. The only difference is that the session will not be locked during the request. This limitation is by-design