I was thinking of the "#disabled" attribute.

 
Nancy
Injustice anywhere is a threat to justice everywhere. -- Dr. Martin L. King, Jr.

From: Michael Prasuhn

No, that just means that they can't see the form field, but there is nothing preventing them from posting such data and the form would gladly accept such data.

A better approach would be to use the #access property from hook_form_alter().